@vellumai/assistant 0.7.0 → 0.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -42,10 +42,12 @@
     "@sentry/node": "10.43.0",
     "@vellumai/ces-client": "file:../packages/ces-client",
     "@vellumai/credential-storage": "file:../packages/credential-storage",
-    "@vellumai/service-contracts": "file:../packages/service-contracts",
     "@vellumai/egress-proxy": "file:../packages/egress-proxy",
     "@vellumai/gateway-client": "file:../packages/gateway-client",
+    "@vellumai/service-contracts": "file:../packages/service-contracts",
     "@vellumai/skill-host-contracts": "file:../packages/skill-host-contracts",
+    "@vellumai/slack-text": "file:../packages/slack-text",
+    "@vellumai/twilio-client": "file:../packages/twilio-client",
     "archiver": "7.0.1",
     "commander": "13.1.0",
     "croner": "10.0.1",
@@ -60,6 +62,7 @@
     "playwright": "1.58.2",
     "postgres": "3.4.8",
     "rrule": "2.8.1",
+    "stemmer": "2.0.1",
     "tar-stream": "3.1.7",
     "tldts": "7.0.25",
     "uuid": "11.1.0",
@@ -75,7 +78,9 @@
     "@vellumai/service-contracts",
     "@vellumai/egress-proxy",
     "@vellumai/gateway-client",
-    "@vellumai/skill-host-contracts"
+    "@vellumai/skill-host-contracts",
+    "@vellumai/slack-text",
+    "@vellumai/twilio-client"
   ],
   "overrides": {
     "lodash": "4.18.1",

package/scripts/generate-openapi.ts

@@ -4,10 +4,9 @@
  * HTTP route definitions.
  *
  * Pipeline:
- *   1. Programmatically import and invoke all *RouteDefinitions() exports
- *      from src/runtime/routes/ — no regex, no source-text parsing.
- *   2. Combine with inline routes (defined in buildRouteTable()) and
- *      pre-auth / non-v1 routes.
+ *   1. Programmatically import every route module under src/runtime/routes/
+ *      and collect all exported ROUTES arrays — no regex, no source-text parsing.
+ *   2. Combine with pre-auth / non-v1 routes.
  *   3. Convert to OpenAPI path items.
  *   4. Write to openapi.yaml.
  *
@@ -132,40 +131,12 @@ function toJSONSchemaObject(schema: unknown): JSONSchemaObject {
 // ---------------------------------------------------------------------------
 
 /**
- * Create a recursive proxy that stands in for any dependency object.
+ * Dynamically import every route module under `src/runtime/routes/`
+ * and collect all exported `ROUTES` arrays.
  *
- * Route definition functions capture deps in handler closures but never
- * access them during array construction, so this stub is never actually
- * invoked at runtime — it just needs to be truthy and not throw when
- * properties are read or the value is called as a function.
- */
-function createDeepStub(): unknown {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const stub: any = new Proxy(function () {}, {
-    get(_target, prop) {
-      // Prevent the stub from being treated as a Promise (await-able).
-      if (prop === "then") return undefined;
-      // Prevent infinite iteration.
-      if (prop === Symbol.iterator) return undefined;
-      // String coercion.
-      if (prop === Symbol.toPrimitive) return () => "";
-      return createDeepStub();
-    },
-    apply() {
-      return createDeepStub();
-    },
-  });
-  return stub;
-}
-
-/**
- * Dynamically import every route module under `src/runtime/routes/`,
- * find all exported functions whose names end with `RouteDefinitions`,
- * invoke each with a deep stub as its first argument, and collect the
- * `{ endpoint, method }` pairs from the returned arrays.
- *
- * This replaces the previous regex + balanced-brace scanning approach
- * and automatically picks up new route modules without manual updates.
+ * Each route module is expected to export a `ROUTES: RouteDefinition[]`
+ * constant. The function automatically picks up new route modules
+ * without manual updates.
  */
 async function collectRoutesFromModules(): Promise<RouteEntry[]> {
   const routes: RouteEntry[] = [];
@@ -191,41 +162,13 @@ async function collectRoutesFromModules(): Promise<RouteEntry[]> {
       continue;
     }
 
-    for (const [exportName, exportValue] of Object.entries(mod)) {
-      if (exportName === "ROUTES" && Array.isArray(exportValue)) {
-        for (const raw of exportValue) {
-          const result = RouteEntrySchema.safeParse({
-            ...(typeof raw === "object" && raw !== null ? raw : {}),
-            sourceModule: file,
-          });
-          if (result.success) routes.push(result.data);
-        }
-        continue;
-      }
-
-      if (
-        !exportName.endsWith("RouteDefinitions") ||
-        typeof exportValue !== "function"
-      ) {
-        continue;
-      }
-
-      try {
-        const rawDefs = exportValue(createDeepStub());
-        if (!Array.isArray(rawDefs)) continue;
-        for (const raw of rawDefs) {
-          const result = RouteEntrySchema.safeParse({
-            ...(typeof raw === "object" && raw !== null ? raw : {}),
-            sourceModule: file,
-          });
-          if (result.success) {
-            routes.push(result.data);
-          }
-        }
-      } catch (err) {
-        console.warn(
-          `Warning: ${exportName}() in ${file} threw: ${err instanceof Error ? err.message : err}`,
-        );
+    if ("ROUTES" in mod && Array.isArray(mod.ROUTES)) {
+      for (const raw of mod.ROUTES) {
+        const result = RouteEntrySchema.safeParse({
+          ...(typeof raw === "object" && raw !== null ? raw : {}),
+          sourceModule: file,
+        });
+        if (result.success) routes.push(result.data);
       }
     }
   }
@@ -233,40 +176,6 @@ async function collectRoutesFromModules(): Promise<RouteEntry[]> {
   return routes;
 }
 
-/**
- * Routes defined inline in RuntimeHttpServer.buildRouteTable() that are
- * not exported from any route module. These are kept here because they
- * depend on cross-cutting concerns specific to the RuntimeHttpServer
- * instance (see B2 in the improvement plan for the recommendation to
- * extract these into modules).
- *
- * Whenever buildRouteTable() gains or loses an inline route, this list
- * must be updated manually. Note: `--check` only compares the generated
- * YAML against the committed YAML, so it will NOT catch a missing entry
- * here if openapi.yaml is also stale. Plan items B2/C2 address this gap.
- */
-const INLINE_ROUTES: RouteEntry[] = [
-  { endpoint: "conversations", method: "GET" },
-  { endpoint: "conversations/seen", method: "POST" },
-  { endpoint: "conversations/unread", method: "POST" },
-  { endpoint: "conversations/:id", method: "GET" },
-  { endpoint: "interfaces/:path*", method: "GET" },
-  { endpoint: "internal/twilio/voice-webhook", method: "POST" },
-  { endpoint: "internal/twilio/status", method: "POST" },
-  { endpoint: "internal/twilio/connect-action", method: "POST" },
-  { endpoint: "internal/oauth/callback", method: "POST" },
-];
-
-/**
- * Pre-auth routes handled directly in routeRequest() before the router.
- * These are a small, stable set that bypass JWT authentication and are
- * not part of the declarative route table.
- */
-const PRE_AUTH_ROUTES: RouteEntry[] = [
-  { method: "POST", endpoint: "pairing/request" },
-  { method: "GET", endpoint: "pairing/status" },
-];
-
 /**
  * Top-level routes outside the /v1/ namespace.
  * These are added to the spec separately.
@@ -551,11 +460,7 @@ async function main() {
   const moduleRoutes = await collectRoutesFromModules();
 
   // Combine all route sources
-  const allRoutes: RouteEntry[] = [
-    ...PRE_AUTH_ROUTES,
-    ...INLINE_ROUTES,
-    ...moduleRoutes,
-  ];
+  const allRoutes: RouteEntry[] = moduleRoutes;
 
   // Build the spec
   const spec = buildSpec(allRoutes, version);

package/src/__tests__/agent-wake-override-profile.test.ts

@@ -20,7 +20,8 @@
  * asserts that:
  *   1. The wake forwards `overrideProfile` to `agentLoop.run`.
  *   2. The wake forwards `callSite: "mainAgent"` to `agentLoop.run`.
- *   3. With both set, `RetryProvider.normalizeSendMessageOptions` actually
+ *   3. The wake resolves and forwards the effective max input token budget.
+ *   4. With both routing keys set, `RetryProvider.normalizeSendMessageOptions` actually
  *      invokes the resolver and replaces workspace defaults with the
  *      pinned-profile values.
  */
@@ -69,6 +70,7 @@ interface RunArgs {
   callSite: unknown;
   turnContext: unknown;
   overrideProfile: string | undefined;
+  effectiveMaxInputTokens: number | undefined;
 }
 
 function makeTarget(): {
@@ -93,6 +95,7 @@ function makeTarget(): {
         callSite?: unknown,
         turnContext?: unknown,
         overrideProfile?: string,
+        effectiveMaxInputTokens?: number,
       ) => {
         runArgs.push({
           messages: [...messages],
@@ -102,6 +105,7 @@ function makeTarget(): {
           callSite,
           turnContext,
           overrideProfile,
+          effectiveMaxInputTokens,
         });
         // Return the input verbatim → silent no-op (no assistant tail).
         return messages;
@@ -133,6 +137,22 @@ afterEach(() => {
 describe("wakeAgentForOpportunity — overrideProfile forwarding", () => {
   test("forwards the conversation's pinned overrideProfile + mainAgent callSite to agentLoop.run", async () => {
     mockOverrideProfile = "frontier";
+    mockLlmConfig = LLMSchema.parse({
+      default: {
+        provider: "anthropic",
+        model: "claude-sonnet-4-6",
+        maxTokens: 64000,
+        contextWindow: { maxInputTokens: 200000 },
+      },
+      profiles: {
+        frontier: {
+          contextWindow: { maxInputTokens: 150000 },
+        },
+      },
+      callSites: {
+        mainAgent: {},
+      },
+    }) as Record<string, unknown>;
     const { target, runArgs } = makeTarget();
 
     const result = await wakeAgentForOpportunity(
@@ -155,6 +175,7 @@ describe("wakeAgentForOpportunity — overrideProfile forwarding", () => {
     // short-circuit and silently drop both the call-site config and the
     // pinned override profile.
     expect(runArgs[0]!.callSite).toBe("mainAgent");
+    expect(runArgs[0]!.effectiveMaxInputTokens).toBe(150000);
     // Sanity: the wake-source tag still propagates as requestId.
     expect(runArgs[0]!.requestId).toBe("wake:scheduler");
   });
@@ -179,6 +200,7 @@ describe("wakeAgentForOpportunity — overrideProfile forwarding", () => {
     // maxTokens, effort, etc.). Otherwise the wake silently runs under
     // workspace defaults regardless of any per-call-site configuration.
     expect(runArgs[0]!.callSite).toBe("mainAgent");
+    expect(runArgs[0]!.effectiveMaxInputTokens).toBeGreaterThan(0);
   });
 });
 

package/src/__tests__/anthropic-provider.test.ts

@@ -374,17 +374,53 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     }>;
 
     const userMessages = sent.filter((m) => m.role === "user");
-    // Only the last user message (turn-starting) gets cache_control
-    for (const user of userMessages.slice(0, -1)) {
-      for (const block of user.content) {
-        expect(block.cache_control).toBeUndefined();
-      }
+    // Oldest user message (Turn 1) has no cache_control
+    for (const block of userMessages[0].content) {
+      expect(block.cache_control).toBeUndefined();
     }
+    // Previous-turn anchor (Turn 2) gets 1h cache on its last block to
+    // preserve the cached prefix across turn transitions
+    const prevTurn = userMessages[userMessages.length - 2];
+    const prevTurnLast = prevTurn.content[prevTurn.content.length - 1];
+    expect(prevTurnLast.cache_control).toEqual({
+      type: "ephemeral",
+      ttl: "1h",
+    });
+    // Current-turn anchor (Turn 3) gets 1h cache on its last block
     const lastUser = userMessages[userMessages.length - 1];
     const lastBlock = lastUser.content[lastUser.content.length - 1];
     expect(lastBlock.cache_control).toEqual({ type: "ephemeral", ttl: "1h" });
   });
 
+  test("previous-turn anchor is NOT applied during a tool-use loop", async () => {
+    // When the request is mid tool-use (last msg is a tool_result), the
+    // turn-start anchor already covers the long prefix, so we must not
+    // place a second anchor on the prior turn — that would push us over
+    // the 4-breakpoint budget without adding cache value.
+    const messages: Message[] = [
+      userMsg("Turn 1"),
+      assistantMsg("Response 1"),
+      userMsg("Turn 2"),
+      toolUseMsg("tu_1", "bash"),
+      toolResultMsg("tu_1", "output"),
+    ];
+    await provider.sendMessage(messages);
+
+    const sent = lastStreamParams!.messages as Array<{
+      role: string;
+      content: Array<{
+        type: string;
+        cache_control?: { type: string; ttl?: string };
+      }>;
+    }>;
+    // Turn 1 user message must have no cache_control (would be the
+    // prev-turn-anchor if we applied it, which we shouldn't here)
+    const turn1 = sent[0];
+    for (const block of turn1.content) {
+      expect(block.cache_control).toBeUndefined();
+    }
+  });
+
   // -----------------------------------------------------------------------
   // Negative: assistant messages never get cache_control
   // -----------------------------------------------------------------------
@@ -1621,7 +1657,7 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     expect(sent[4].content[0].text).toBe("Follow-up question");
   });
 
-  test("multi-turn with workspace injection: only last user message gets 1h cache", async () => {
+  test("multi-turn with workspace injection: prev-turn + last user message get 1h cache", async () => {
     const messages: Message[] = [
       {
         role: "user",
@@ -1669,14 +1705,21 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     const userMsgs = sent.filter((m) => m.role === "user");
     expect(userMsgs).toHaveLength(3);
 
-    // Earlier user messages: no cache_control
-    for (const user of userMsgs.slice(0, -1)) {
-      for (const block of user.content) {
-        expect(block.cache_control).toBeUndefined();
-      }
+    // Oldest user message (turn 1): no cache_control
+    for (const block of userMsgs[0].content) {
+      expect(block.cache_control).toBeUndefined();
     }
 
-    // Last user message (turn 3): 1h cache on last block only
+    // Previous-turn anchor (turn 2): 1h cache on last block to preserve the
+    // cached prefix across turn transitions
+    const prevTurn = userMsgs[userMsgs.length - 2];
+    expect(prevTurn.content[0].cache_control).toBeUndefined();
+    expect(prevTurn.content[1].cache_control).toEqual({
+      type: "ephemeral",
+      ttl: "1h",
+    });
+
+    // Current-turn anchor (turn 3): 1h cache on last block
     const lastUser = userMsgs[userMsgs.length - 1];
     expect(lastUser.content[0].cache_control).toBeUndefined();
     expect(lastUser.content[1].cache_control).toEqual({
@@ -2100,7 +2143,7 @@ describe("AnthropicProvider — Haiku Model Gating", () => {
     expect(system[0].cache_control).not.toHaveProperty("ttl");
   });
 
-  test("betas array is empty for Haiku (no extended cache TTL or 1M context)", async () => {
+  test("betas array is empty for Haiku (no extended cache TTL)", async () => {
     await provider.sendMessage([userMsg("Hi")], undefined, "You are helpful.");
 
     // When betas is empty, the non-beta stream path is used, so no betas

package/src/__tests__/app-builder-tool-scripts.test.ts

@@ -93,7 +93,7 @@ describe("app-builder skill tool scripts", () => {
 
     test("delegates to executeAppCreate and returns result", async () => {
       const result = await appCreateScript.run(
-        { name: "My App", html: "<p>Hello</p>" },
+        { name: "My App" },
         makeContext(),
       );
       expect(result.isError).toBe(false);
@@ -107,7 +107,7 @@ describe("app-builder skill tool scripts", () => {
         isError: false,
       });
       const result = await appCreateScript.run(
-        { name: "Auto App", html: "<div/>" },
+        { name: "Auto App" },
         makeContext({ proxyToolResolver: proxy }),
       );
       expect(result.isError).toBe(false);
@@ -118,7 +118,7 @@ describe("app-builder skill tool scripts", () => {
 
     test("handles missing proxyToolResolver gracefully", async () => {
       const result = await appCreateScript.run(
-        { name: "No Proxy", html: "<p/>" },
+        { name: "No Proxy" },
         makeContext(),
       );
       expect(result.isError).toBe(false);

package/src/__tests__/app-bundler.test.ts

@@ -1,4 +1,10 @@
-import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { readFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -22,6 +28,8 @@ const mockApps = new Map<string, Record<string, unknown>>();
 mock.module("../memory/app-store.js", () => ({
   getApp: (id: string) => mockApps.get(id) ?? null,
   getAppsDir: () => testAppsDir,
+  getAppDirPath: (id: string) => join(testAppsDir, id),
+  isMultifileApp: (app: Record<string, unknown>) => app.formatVersion === 2,
 }));
 
 // Mock content-id to avoid pulling in crypto internals
@@ -29,6 +37,52 @@ mock.module("../util/content-id.js", () => ({
   computeContentId: () => "abcd1234abcd1234",
 }));
 
+let compileAppOverride:
+  | ((appDir: string) => Promise<{
+      ok: boolean;
+      errors: Array<{
+        text: string;
+        location?: { file: string; line: number; column: number };
+      }>;
+      warnings: Array<{ text: string }>;
+      durationMs: number;
+    }>)
+  | undefined;
+
+async function compileAppFixture(appDir: string) {
+  if (compileAppOverride) {
+    return compileAppOverride(appDir);
+  }
+
+  const srcDir = join(appDir, "src");
+  const distDir = join(appDir, "dist");
+  rmSync(distDir, { recursive: true, force: true });
+  mkdirSync(distDir, { recursive: true });
+
+  let html = readFileSync(join(srcDir, "index.html"), "utf-8");
+  const cssPath = join(srcDir, "styles.css");
+  if (existsSync(cssPath)) {
+    writeFileSync(join(distDir, "main.css"), readFileSync(cssPath));
+    html = html.replace(
+      "</head>",
+      '  <link rel="stylesheet" href="main.css">\n  </head>',
+    );
+  }
+  html = html.replace(
+    "</body>",
+    '  <script type="module" src="main.js"></script>\n  </body>',
+  );
+
+  writeFileSync(join(distDir, "index.html"), html);
+  writeFileSync(join(distDir, "main.js"), "console.log('compiled');");
+
+  return { ok: true, errors: [], warnings: [], durationMs: 1 };
+}
+
+mock.module("../bundler/app-compiler.js", () => ({
+  compileApp: compileAppFixture,
+}));
+
 // Mock bundle-signer (not exercised in these tests)
 mock.module("./bundle-signer.js", () => ({
   signBundle: async () => ({}),
@@ -43,6 +97,7 @@ import type { AppManifest } from "../bundler/manifest.js";
 
 describe("packageApp", () => {
   afterEach(() => {
+    compileAppOverride = undefined;
     mockApps.clear();
     try {
       rmSync(testAppsDir, { recursive: true, force: true });
@@ -92,6 +147,29 @@ describe("packageApp", () => {
     return appDef;
   }
 
+  function setupLegacyApp(appId: string) {
+    const appDir = join(testAppsDir, appId);
+    mkdirSync(appDir, { recursive: true });
+    writeFileSync(
+      join(appDir, "index.html"),
+      "<!DOCTYPE html><html><body><h1>Legacy</h1></body></html>",
+    );
+
+    const appDef = {
+      id: appId,
+      name: "Legacy App",
+      description: "A legacy app",
+      schemaJson: "{}",
+      htmlDefinition: "<unused>",
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+    };
+    writeFileSync(join(testAppsDir, `${appId}.json`), JSON.stringify(appDef));
+    mockApps.set(appId, appDef);
+
+    return appDef;
+  }
+
   test("packages an app with compiled dist/ files in the zip", async () => {
     const appId = "multi-test-1";
     setupApp(appId, { withCss: true });
@@ -140,6 +218,17 @@ describe("packageApp", () => {
     const appDir = join(testAppsDir, appId);
     const srcDir = join(appDir, "src");
     mkdirSync(srcDir, { recursive: true });
+    compileAppOverride = async () => ({
+      ok: false,
+      errors: [
+        {
+          text: "Expected identifier",
+          location: { file: "src/main.tsx", line: 1, column: 20 },
+        },
+      ],
+      warnings: [],
+      durationMs: 1,
+    });
 
     // Write intentionally broken source so esbuild fails
     writeFileSync(join(srcDir, "main.tsx"), "const x: number = {{{BROKEN");
@@ -165,6 +254,70 @@ describe("packageApp", () => {
     );
   });
 
+  test("rejects formatVersion 2 apps missing src files before bundling", async () => {
+    const appId = "multi-missing-src";
+    const appDir = join(testAppsDir, appId);
+    mkdirSync(appDir, { recursive: true });
+    writeFileSync(
+      join(appDir, "index.html"),
+      "<!DOCTYPE html><html><body><h1>Wrong root</h1></body></html>",
+    );
+
+    const appDef = {
+      id: appId,
+      name: "Missing Source App",
+      schemaJson: "{}",
+      htmlDefinition: "<unused>",
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      formatVersion: 2,
+    };
+    writeFileSync(join(testAppsDir, `${appId}.json`), JSON.stringify(appDef));
+    mockApps.set(appId, appDef);
+
+    await expect(packageApp(appId)).rejects.toThrow(
+      /missing src\/index\.html and src\/main\.tsx/,
+    );
+  });
+
+  test("rejects app_create scaffold before sharing", async () => {
+    const appId = "multi-default-scaffold";
+    const appDir = join(testAppsDir, appId);
+    const srcDir = join(appDir, "src");
+    mkdirSync(srcDir, { recursive: true });
+    writeFileSync(
+      join(srcDir, "index.html"),
+      '<!DOCTYPE html><html><body><div id="app"></div></body></html>',
+    );
+    writeFileSync(
+      join(srcDir, "main.tsx"),
+      `import { render } from 'preact';
+
+function App() {
+  return <div>{"Hello, Scaffold!"}</div>;
+}
+
+render(<App />, document.getElementById('app')!);
+`,
+    );
+
+    const appDef = {
+      id: appId,
+      name: "Scaffold App",
+      schemaJson: "{}",
+      htmlDefinition: "<unused>",
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      formatVersion: 2,
+    };
+    writeFileSync(join(testAppsDir, `${appId}.json`), JSON.stringify(appDef));
+    mockApps.set(appId, appDef);
+
+    await expect(packageApp(appId)).rejects.toThrow(
+      /still has the default src\/main\.tsx scaffold/,
+    );
+  });
+
   test("app without CSS omits main.css from zip", async () => {
     const appId = "multi-no-css";
     setupApp(appId, { withCss: false });
@@ -177,4 +330,20 @@ describe("packageApp", () => {
     expect(zip.file("main.js")).not.toBeNull();
     expect(zip.file("main.css")).toBeNull();
   });
+
+  test("keeps legacy single-file apps packageable", async () => {
+    const appId = "legacy-single-file";
+    setupLegacyApp(appId);
+
+    const result = await packageApp(appId);
+    const zipData = await readFile(result.bundlePath);
+    const zip = await JSZip.loadAsync(zipData);
+
+    const indexContent = await zip.file("index.html")!.async("string");
+    const manifestJson = await zip.file("manifest.json")!.async("string");
+    const manifest: AppManifest = JSON.parse(manifestJson);
+
+    expect(indexContent).toContain("<h1>Legacy</h1>");
+    expect(manifest.format_version).toBe(1);
+  });
 });