@vellumai/assistant 0.7.0 → 0.7.1

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -0,0 +1,235 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+mock.module("../../../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+import {
+  sampleConcepts as sharedSampleConcepts,
+  sampleConfig,
+  sampleSkills,
+} from "../../../memory/__tests__/fixtures/memory-v2-activation-fixtures.js";
+
+let rawConfigFixture: Record<string, unknown> = {};
+let savedRawConfig: Record<string, unknown> | null = null;
+
+mock.module("../../../config/loader.js", () => ({
+  loadRawConfig: () => structuredClone(rawConfigFixture),
+  saveRawConfig: (raw: Record<string, unknown>) => {
+    savedRawConfig = raw;
+  },
+  deepMergeOverwrite: (
+    target: Record<string, unknown>,
+    overrides: Record<string, unknown>,
+  ) => {
+    Object.assign(target, overrides);
+  },
+}));
+
+import { getDb } from "../../../memory/db-connection.js";
+import { initializeDb } from "../../../memory/db-init.js";
+import {
+  backfillMemoryV2ActivationMessageId,
+  type MemoryV2ConceptRowRecord,
+  type MemoryV2ConfigSnapshot,
+  type MemoryV2SkillRowRecord,
+  recordMemoryV2ActivationLog,
+} from "../../../memory/memory-v2-activation-log-store.js";
+import {
+  llmRequestLogs,
+  memoryV2ActivationLogs,
+} from "../../../memory/schema.js";
+import { ROUTES } from "../conversation-query-routes.js";
+
+// Local subset: this test only exercises a single concept row.
+const sampleConcepts: MemoryV2ConceptRowRecord[] = sharedSampleConcepts.slice(
+  0,
+  1,
+);
+
+initializeDb();
+
+const llmContextRoute = ROUTES.find(
+  (r) => r.method === "GET" && r.endpoint === "messages/:id/llm-context",
+)!;
+
+const replaceProfileRoute = ROUTES.find(
+  (r) => r.operationId === "config_llm_profiles_replace",
+)!;
+
+function dispatchLlmContext(messageId: string) {
+  return llmContextRoute.handler({ pathParams: { id: messageId } });
+}
+
+function clearTables(): void {
+  const db = getDb();
+  db.delete(llmRequestLogs).run();
+  db.delete(memoryV2ActivationLogs).run();
+}
+
+function seedRequestLog(messageId: string, id: string): void {
+  getDb()
+    .insert(llmRequestLogs)
+    .values({
+      id,
+      conversationId: "conv-1",
+      messageId,
+      provider: "openai",
+      requestPayload: JSON.stringify({ model: "gpt-4.1", messages: [] }),
+      responsePayload: JSON.stringify({
+        choices: [{ message: { content: "hi" } }],
+      }),
+      createdAt: 1_700_000_000_000,
+    })
+    .run();
+}
+
+describe("GET /v1/messages/:id/llm-context — memoryV2Activation", () => {
+  beforeEach(() => {
+    clearTables();
+  });
+
+  test("returns null memoryV2Activation when no v2 log exists for the turn", async () => {
+    const messageId = "msg-no-v2";
+    seedRequestLog(messageId, "log-no-v2");
+
+    const body = (await dispatchLlmContext(messageId)) as {
+      memoryV2Activation: unknown;
+      memoryRecall: unknown;
+    };
+
+    expect(body.memoryV2Activation).toBeNull();
+    // Backwards-compat: memoryRecall remains.
+    expect(body).toHaveProperty("memoryRecall");
+  });
+
+  test("returns the recorded v2 activation log on the response", async () => {
+    const conversationId = "conv-v2";
+    const messageId = "msg-v2-present";
+
+    seedRequestLog(messageId, "log-v2-present");
+    recordMemoryV2ActivationLog({
+      conversationId,
+      turn: 4,
+      mode: "per-turn",
+      concepts: sampleConcepts,
+      skills: sampleSkills,
+      config: sampleConfig,
+    });
+    backfillMemoryV2ActivationMessageId(conversationId, messageId);
+
+    const body = (await dispatchLlmContext(messageId)) as {
+      memoryV2Activation: {
+        turn: number;
+        mode: "context-load" | "per-turn";
+        concepts: MemoryV2ConceptRowRecord[];
+        skills: MemoryV2SkillRowRecord[];
+        config: MemoryV2ConfigSnapshot;
+      } | null;
+      memoryRecall: unknown;
+    };
+
+    expect(body.memoryV2Activation).not.toBeNull();
+    expect(body.memoryV2Activation!.turn).toBe(4);
+    expect(body.memoryV2Activation!.mode).toBe("per-turn");
+    expect(body.memoryV2Activation!.concepts).toEqual(sampleConcepts);
+    expect(body.memoryV2Activation!.skills).toEqual(sampleSkills);
+    expect(body.memoryV2Activation!.config).toEqual(sampleConfig);
+    // Backwards-compat: memoryRecall field still present.
+    expect(body).toHaveProperty("memoryRecall");
+  });
+});
+
+describe("PUT /v1/config/llm/profiles/:name", () => {
+  beforeEach(() => {
+    savedRawConfig = null;
+    rawConfigFixture = {
+      llm: {
+        profiles: {
+          custom: {
+            provider: "anthropic",
+            model: "claude-sonnet-4-6",
+            maxTokens: 32000,
+            contextWindow: {
+              maxInputTokens: 900000,
+              targetBudgetRatio: 0.3,
+              summaryBudgetRatio: 0.08,
+              overflowRecovery: {
+                enabled: true,
+                maxAttempts: 4,
+              },
+            },
+            openrouter: {
+              only: ["anthropic"],
+            },
+          },
+        },
+      },
+    };
+  });
+
+  test("owns contextWindow maxInputTokens while preserving non-UI profile leaves", () => {
+    const result = replaceProfileRoute.handler({
+      pathParams: { name: "custom" },
+      body: {
+        provider: "openai",
+        model: "gpt-5.5",
+      },
+    });
+
+    expect(result).toEqual({ ok: true });
+    const savedProfile = (
+      savedRawConfig?.llm as {
+        profiles: Record<string, Record<string, unknown>>;
+      }
+    ).profiles.custom;
+
+    expect(savedProfile.provider).toBe("openai");
+    expect(savedProfile.model).toBe("gpt-5.5");
+    expect(savedProfile.maxTokens).toBeUndefined();
+    expect(savedProfile.contextWindow).toEqual({
+      targetBudgetRatio: 0.3,
+      summaryBudgetRatio: 0.08,
+      overflowRecovery: {
+        enabled: true,
+        maxAttempts: 4,
+      },
+    });
+    expect(savedProfile.openrouter).toEqual({ only: ["anthropic"] });
+  });
+
+  test("writes only the replacement contextWindow maxInputTokens override", () => {
+    const result = replaceProfileRoute.handler({
+      pathParams: { name: "custom" },
+      body: {
+        provider: "openai",
+        model: "gpt-5.5",
+        contextWindow: {
+          maxInputTokens: 150000,
+          summaryBudgetRatio: 0.2,
+        },
+      },
+    });
+
+    expect(result).toEqual({ ok: true });
+    const savedProfile = (
+      savedRawConfig?.llm as {
+        profiles: Record<string, Record<string, unknown>>;
+      }
+    ).profiles.custom;
+
+    expect(savedProfile.contextWindow).toEqual({
+      maxInputTokens: 150000,
+      targetBudgetRatio: 0.3,
+      summaryBudgetRatio: 0.08,
+      overflowRecovery: {
+        enabled: true,
+        maxAttempts: 4,
+      },
+    });
+    expect(savedProfile.openrouter).toEqual({ only: ["anthropic"] });
+  });
+});

package/src/runtime/routes/__tests__/llm-call-sites-routes.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, test } from "bun:test";
+
+import { LLMCallSiteEnum } from "../../../config/schemas/llm.js";
+import { ROUTES } from "../llm-call-sites-routes.js";
+
+const route = ROUTES.find((r) => r.operationId === "llm_call_sites_list")!;
+
+describe("llm-call-sites-routes", () => {
+  test("route is defined with correct method and endpoint", () => {
+    expect(route).toBeDefined();
+    expect(route.method).toBe("GET");
+    expect(route.endpoint).toBe("config/llm/call-sites");
+  });
+
+  test("response has domains and callSites arrays", async () => {
+    const result = (await route.handler({})) as {
+      domains: unknown[];
+      callSites: unknown[];
+    };
+    expect(Array.isArray(result.domains)).toBe(true);
+    expect(Array.isArray(result.callSites)).toBe(true);
+  });
+
+  test("all call site IDs match LLMCallSiteEnum", async () => {
+    const result = (await route.handler({})) as {
+      callSites: Array<{ id: string; displayName: string; description: string; domain: string }>;
+    };
+    const validIds = new Set(LLMCallSiteEnum.options);
+    for (const site of result.callSites) {
+      expect(validIds.has(site.id as never)).toBe(true);
+      expect(site.displayName).toBeTruthy();
+      expect(site.description).toBeTruthy();
+    }
+    expect(result.callSites.length).toBe(LLMCallSiteEnum.options.length);
+  });
+
+  test("all call site domain references match defined domains", async () => {
+    const result = (await route.handler({})) as {
+      domains: Array<{ id: string; displayName: string }>;
+      callSites: Array<{ id: string; domain: string }>;
+    };
+    const domainIds = new Set(result.domains.map((d) => d.id));
+    for (const site of result.callSites) {
+      expect(domainIds.has(site.domain)).toBe(true);
+    }
+  });
+
+  test("domains have non-empty id and displayName", async () => {
+    const result = (await route.handler({})) as {
+      domains: Array<{ id: string; displayName: string }>;
+    };
+    expect(result.domains.length).toBeGreaterThan(0);
+    for (const domain of result.domains) {
+      expect(domain.id).toBeTruthy();
+      expect(domain.displayName).toBeTruthy();
+    }
+  });
+});

package/src/runtime/routes/__tests__/migration-export-secrets-redacted.test.ts

@@ -0,0 +1,54 @@
+/**
+ * Unit tests for `computeSecretsRedacted`.
+ *
+ * The helper decides whether the v1 manifest may truthfully claim
+ * `secrets_redacted: true`. Three signals feed in:
+ *   - credentialCount: number of credentials actually included in the bundle.
+ *   - storeUnreachable: top-level `listSecureKeysAsync()` failed — we never
+ *     enumerated the accounts.
+ *   - perAccountUnreachable: enumeration succeeded, but at least one
+ *     `getSecureKeyResultAsync(account)` returned `unreachable: true`. Those
+ *     accounts were silently skipped from the credentials array, so a zero
+ *     count could be hiding real secrets we just couldn't read.
+ *
+ * Only the all-clear case (zero credentials, both flags false) may return
+ * true. Any failure mode forces false — claiming a clean redaction in those
+ * cases would lie about what's in the bundle.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { computeSecretsRedacted } from "../migration-routes.js";
+
+describe("computeSecretsRedacted", () => {
+  test("genuinely empty store + reachable + no per-account failures → true", () => {
+    expect(computeSecretsRedacted(0, false, false)).toBe(true);
+  });
+
+  test("top-level store unreachable → false (couldn't read at all)", () => {
+    expect(computeSecretsRedacted(0, true, false)).toBe(false);
+  });
+
+  test("per-account read failure → false (partial read failure)", () => {
+    expect(computeSecretsRedacted(0, false, true)).toBe(false);
+  });
+
+  test("both top-level and per-account failures → false", () => {
+    expect(computeSecretsRedacted(0, true, true)).toBe(false);
+  });
+
+  test("credentials included + no failures → false (creds in bundle)", () => {
+    expect(computeSecretsRedacted(3, false, false)).toBe(false);
+  });
+
+  test("credentials included + per-account failure → false (creds + partial failure)", () => {
+    expect(computeSecretsRedacted(3, false, true)).toBe(false);
+  });
+
+  test("credentials included + store unreachable → false", () => {
+    // Defensive: in practice `storeUnreachable` implies zero credentials,
+    // but the helper should still behave correctly if a caller passes a
+    // non-zero count alongside an unreachable flag.
+    expect(computeSecretsRedacted(3, true, false)).toBe(false);
+  });
+});

package/src/runtime/routes/__tests__/migration-import-credential-filter.test.ts

@@ -51,16 +51,29 @@ function makeTarEntry(data: string): VBundleTarEntry {
 
 function makeManifest(paths: string[]): ManifestType {
   return {
-    schema_version: "1.0.0",
+    schema_version: 1,
+    bundle_id: "00000000-0000-4000-8000-000000000000",
     created_at: new Date().toISOString(),
-    source: "test",
-    manifest_sha256: "test",
-    files: paths.map((path) => ({
+    assistant: { id: "self", name: "Test", runtime_version: "0.0.0-test" },
+    origin: { mode: "self-hosted-local" },
+    compatibility: {
+      min_runtime_version: "0.0.0-test",
+      max_runtime_version: null,
+    },
+    contents: paths.map((path) => ({
       path,
-      size: 0,
+      size_bytes: 0,
       sha256: "test",
     })),
-  } as ManifestType;
+    checksum:
+      "0000000000000000000000000000000000000000000000000000000000000000",
+    secrets_redacted: false,
+    export_options: {
+      include_logs: false,
+      include_browser_state: false,
+      include_memory_vectors: false,
+    },
+  } as unknown as ManifestType;
 }
 
 /**

package/src/runtime/routes/__tests__/user-route-dispatcher.test.ts

@@ -23,9 +23,7 @@ import { UserRouteDispatcher } from "../user-route-dispatcher.js";
 // ---------------------------------------------------------------------------
 
 /** Build a minimal UserRouteContext for tests. */
-function makeContext(
-  overrides?: Partial<UserRouteContext>,
-): UserRouteContext {
+function makeContext(overrides?: Partial<UserRouteContext>): UserRouteContext {
   return {
     assistantEventHub: new AssistantEventHub(),
     assistantId: "test-assistant",
@@ -446,10 +444,12 @@ describe("context injection", () => {
 
     const hub = new AssistantEventHub();
     const received: unknown[] = [];
-    hub.subscribe(
-      { assistantId: "test-assistant" },
-      (event) => { received.push(event); },
-    );
+    hub.subscribe({
+      type: "process",
+      callback: (event) => {
+        received.push(event);
+      },
+    });
 
     const ctx = makeContext({ assistantEventHub: hub });
     const dispatcher = makeDispatcher({ context: ctx });

package/src/runtime/routes/acp-routes.test.ts

@@ -57,9 +57,6 @@ mock.module("../../acp/index.js", () => ({
       return state;
     },
   }),
-  // Spawn and bulk-DELETE tests don't reach this code path, but the mock
-  // factory must export every name the SUT imports.
-  broadcastToAllClients: null,
 }));
 
 import { eq } from "drizzle-orm";

package/src/runtime/routes/acp-routes.ts

@@ -7,15 +7,13 @@
 import { desc, eq, inArray } from "drizzle-orm";
 import { z } from "zod";
 
-import {
-  broadcastToAllClients,
-  getAcpSessionManager,
-} from "../../acp/index.js";
+import { getAcpSessionManager } from "../../acp/index.js";
 import { resolveAcpAgent } from "../../acp/resolve-agent.js";
 import type { AcpSessionState } from "../../acp/types.js";
 import { getDb } from "../../memory/db-connection.js";
 import { rawChanges } from "../../memory/raw-query.js";
 import { acpSessionHistory } from "../../memory/schema.js";
+import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { getLogger } from "../../util/logger.js";
 import {
   BadRequestError,
@@ -91,15 +89,13 @@ async function spawnSession({ body }: RouteHandlerArgs) {
   );
 
   const manager = getAcpSessionManager();
-  const sendToVellum =
-    broadcastToAllClients ?? ((_msg: unknown) => log.warn("No broadcast fn set"));
   const { acpSessionId, protocolSessionId } = await manager.spawn(
     agent,
     resolved.agent,
     task,
     cwd,
     conversationId,
-    sendToVellum,
+    broadcastMessage,
   );
 
   log.info({ acpSessionId, protocolSessionId, agent }, "ACP spawn succeeded");

package/src/runtime/routes/app-management-routes.ts

@@ -28,6 +28,7 @@ import {
   restoreAppVersion,
 } from "../../memory/app-git-service.js";
 import {
+  type AppDefinition,
   createApp,
   createAppRecord,
   deleteApp,
@@ -37,6 +38,7 @@ import {
   getAppPreview,
   isMultifileApp,
   listApps,
+  listAppsByConversation,
   queryAppRecords,
   resolveAppDir,
   resolveEffectiveAppHtml,
@@ -69,7 +71,7 @@ function getSharedAppsDir(): string {
 // Extracted business logic
 // ---------------------------------------------------------------------------
 
-function listAppsFiltered(): Array<{
+function listAppsFiltered(apps?: AppDefinition[]): Array<{
   id: string;
   name: string;
   description?: string;
@@ -78,7 +80,7 @@ function listAppsFiltered(): Array<{
   version: string;
   contentId: string;
 }> {
-  return listApps().map((a) => {
+  return (apps ?? listApps()).map((a) => {
     const version = a.version ?? "1.0.0";
     const contentId = computeContentId(a.name);
     return {
@@ -354,7 +356,11 @@ async function openBundle(filePath: string): Promise<Record<string, unknown>> {
 // Route handlers
 // ---------------------------------------------------------------------------
 
-function handleListApps() {
+function handleListApps({ queryParams }: RouteHandlerArgs) {
+  const conversationId = queryParams?.conversationId;
+  if (conversationId) {
+    return { apps: listAppsFiltered(listAppsByConversation(conversationId)) };
+  }
   return { apps: listAppsFiltered() };
 }
 
@@ -511,10 +517,7 @@ function handleUpdatePreview({ pathParams, body }: RouteHandlerArgs) {
   return { success: true, appId };
 }
 
-async function handleGetHistory({
-  pathParams,
-  queryParams,
-}: RouteHandlerArgs) {
+async function handleGetHistory({ pathParams, queryParams }: RouteHandlerArgs) {
   const appId = pathParams?.id as string;
   const limit = queryParams?.limit ? Number(queryParams.limit) : undefined;
   const versions = await getAppHistory(appId, limit);
@@ -578,6 +581,13 @@ export const ROUTES: RouteDefinition[] = [
     summary: "List apps",
     description: "Return all locally installed apps.",
     tags: ["apps"],
+    queryParams: [
+      {
+        name: "conversationId",
+        schema: { type: "string" },
+        description: "Filter apps by conversation ID",
+      },
+    ],
     responseBody: z.object({
       apps: z.array(z.unknown()).describe("Array of app summary objects"),
     }),
@@ -716,8 +726,7 @@ export const ROUTES: RouteDefinition[] = [
     policyKey: "apps/open",
     handler: handleOpenApp,
     summary: "Open an app",
-    description:
-      "Compile (if needed) and return the app's HTML for rendering.",
+    description: "Compile (if needed) and return the app's HTML for rendering.",
     tags: ["apps"],
     responseBody: z.object({
       appId: z.string(),

package/src/runtime/routes/approval-routes.ts

@@ -9,6 +9,7 @@
  */
 import { z } from "zod";
 
+import { findConversation } from "../../daemon/conversation-store.js";
 import { emitFeedEvent } from "../../home/emit-feed-event.js";
 import { getConversationByKey } from "../../memory/conversation-key-store.js";
 import type { UserDecision } from "../../permissions/types.js";
@@ -97,7 +98,14 @@ function handleConfirm({ body }: RouteHandlerArgs) {
     return { accepted: true };
   }
 
-  interaction.conversation!.handleConfirmationResponse(
+  const conversation = findConversation(interaction.conversationId);
+  if (!conversation) {
+    throw new NotFoundError(
+      "Conversation not found for this pending confirmation",
+    );
+  }
+
+  conversation.handleConfirmationResponse(
     requestId,
     effectiveDecision as UserDecision,
     selectedPattern,
@@ -136,7 +144,14 @@ function handleSecret({ body }: RouteHandlerArgs) {
     throw new NotFoundError("No pending interaction found for this requestId");
   }
 
-  interaction.conversation!.handleSecretResponse(
+  const conversation = findConversation(interaction.conversationId);
+  if (!conversation) {
+    throw new NotFoundError(
+      "Conversation not found for this pending secret request",
+    );
+  }
+
+  conversation.handleSecretResponse(
     requestId,
     value,
     delivery as "store" | "transient_send" | undefined,
@@ -147,24 +162,35 @@ function handleSecret({ body }: RouteHandlerArgs) {
 /**
  * GET /v1/pending-interactions?conversationKey=...&conversationId=...
  *
- * Returns pending confirmations and secrets for a conversation, allowing
- * polling-based clients (like the CLI) to discover approval requests
- * without SSE.
+ * Returns pending interactions. When conversationKey or conversationId is
+ * provided, returns the first pending confirmation and secret for that
+ * conversation. When neither is provided, returns all pending interactions
+ * across all conversations (diagnostic mode).
  */
 function handleListPendingInteractions({ queryParams }: RouteHandlerArgs) {
   const conversationKey = queryParams?.conversationKey;
   const conversationId = queryParams?.conversationId;
 
+  // When no filters are provided, return all interactions (diagnostic mode).
+  if (!conversationId && !conversationKey) {
+    const all = pendingInteractions.getAll();
+    return {
+      interactions: all.map((i) => ({
+        requestId: i.requestId,
+        conversationId: i.conversationId,
+        kind: i.kind,
+        toolName: i.confirmationDetails?.toolName,
+        riskLevel: i.confirmationDetails?.riskLevel,
+      })),
+    };
+  }
+
   let resolvedConversationId: string | undefined;
   if (conversationId) {
     resolvedConversationId = conversationId;
   } else if (conversationKey) {
     const mapping = getConversationByKey(conversationKey);
     resolvedConversationId = mapping?.conversationId;
-  } else {
-    throw new BadRequestError(
-      "conversationKey or conversationId query parameter is required",
-    );
   }
 
   if (!resolvedConversationId) {
@@ -266,27 +292,42 @@ export const ROUTES: RouteDefinition[] = [
     method: "GET",
     handler: handleListPendingInteractions,
     summary: "List pending interactions",
-    description: "Return pending confirmations and secrets for a conversation.",
+    description:
+      "Return pending interactions. When conversationKey or conversationId is provided, returns details for that conversation. When neither is provided, returns all pending interactions.",
     tags: ["approvals"],
     queryParams: [
       {
         name: "conversationKey",
-        description: "Conversation key",
+        description: "Conversation key (optional)",
       },
       {
         name: "conversationId",
-        description: "Conversation ID",
+        description: "Conversation ID (optional)",
       },
     ],
     responseBody: z.object({
       pendingConfirmation: z
         .object({})
         .passthrough()
-        .describe("Pending confirmation details or null"),
+        .describe("Pending confirmation details or null")
+        .optional(),
       pendingSecret: z
         .object({})
         .passthrough()
-        .describe("Pending secret request or null"),
+        .describe("Pending secret request or null")
+        .optional(),
+      interactions: z
+        .array(
+          z.object({
+            requestId: z.string(),
+            conversationId: z.string(),
+            kind: z.string(),
+            toolName: z.string().optional(),
+            riskLevel: z.string().optional(),
+          }),
+        )
+        .describe("All pending interactions (returned when no filters given)")
+        .optional(),
     }),
   },
 ];