@vellumai/assistant 0.8.1 → 0.8.3

package/src/__tests__/delete-managed-skill-tool.test.ts

@@ -9,6 +9,7 @@ import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 const TEST_DIR = process.env.VELLUM_WORKSPACE_DIR!;
+const mockRefreshSkillCapabilityMemories = mock(() => {});
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -17,6 +18,10 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
+mock.module("../daemon/skill-memory-refresh.js", () => ({
+  refreshSkillCapabilityMemories: mockRefreshSkillCapabilityMemories,
+}));
+
 import { executeDeleteManagedSkill } from "../tools/skills/delete-managed.js";
 import type { ToolContext } from "../tools/types.js";
 
@@ -35,16 +40,11 @@ function createSkill(id: string): void {
     join(skillDir, "SKILL.md"),
     '---\nname: "Test"\ndescription: "Test"\n---\n\nBody.\n',
   );
-  // Update SKILLS.md
-  const indexPath = join(TEST_DIR, "skills", "SKILLS.md");
-  const existing = existsSync(indexPath)
-    ? readFileSync(indexPath, "utf-8")
-    : "";
-  writeFileSync(indexPath, existing + `- ${id}\n`);
 }
 
 beforeEach(() => {
   mkdirSync(join(TEST_DIR, "skills"), { recursive: true });
+  mockRefreshSkillCapabilityMemories.mockClear();
 });
 
 afterEach(() => {
@@ -52,9 +52,34 @@ afterEach(() => {
 });
 
 describe("delete_managed_skill tool", () => {
-  test("deletes existing skill and updates index", async () => {
+  test("keeps legacy index control as a deprecated no-op schema field", () => {
+    const tools = JSON.parse(
+      readFileSync(
+        join(
+          import.meta.dirname,
+          "../config/bundled-skills/skill-management/TOOLS.json",
+        ),
+        "utf-8",
+      ),
+    );
+    const deleteTool = tools.tools.find(
+      (tool: { name: string }) => tool.name === "delete_managed_skill",
+    );
+
+    expect(deleteTool).toBeDefined();
+    expect(deleteTool.input_schema.properties.remove_from_index).toEqual({
+      type: "boolean",
+      description:
+        "Deprecated no-op compatibility field. Skill deletion does not edit SKILLS.md.",
+    });
+  });
+
+  test("deletes existing skill without modifying the legacy index", async () => {
     createSkill("doomed");
     createSkill("survivor");
+    const indexPath = join(TEST_DIR, "skills", "SKILLS.md");
+    const staleIndex = "- doomed\n- survivor\n";
+    writeFileSync(indexPath, staleIndex);
 
     const result = await executeDeleteManagedSkill(
       {
@@ -67,16 +92,32 @@ describe("delete_managed_skill tool", () => {
     const parsed = JSON.parse(result.content);
     expect(parsed.deleted).toBe(true);
     expect(parsed.skill_id).toBe("doomed");
-    expect(parsed.index_updated).toBe(true);
+    expect(parsed).not.toHaveProperty("index_updated");
 
     expect(existsSync(join(TEST_DIR, "skills", "doomed"))).toBe(false);
 
-    const indexContent = readFileSync(
-      join(TEST_DIR, "skills", "SKILLS.md"),
-      "utf-8",
+    expect(existsSync(indexPath)).toBe(true);
+    expect(readFileSync(indexPath, "utf-8")).toBe(staleIndex);
+    expect(mockRefreshSkillCapabilityMemories).toHaveBeenCalledTimes(1);
+  });
+
+  test("accepts legacy remove_from_index input without returning index metadata", async () => {
+    createSkill("legacy-delete");
+
+    const result = await executeDeleteManagedSkill(
+      {
+        skill_id: "legacy-delete",
+        remove_from_index: true,
+      },
+      makeContext(),
     );
-    expect(indexContent).not.toContain("doomed");
-    expect(indexContent).toContain("survivor");
+
+    expect(result.isError).toBe(false);
+    const parsed = JSON.parse(result.content);
+    expect(parsed.deleted).toBe(true);
+    expect(parsed).not.toHaveProperty("index_updated");
+    expect(existsSync(join(TEST_DIR, "skills", "legacy-delete"))).toBe(false);
+    expect(mockRefreshSkillCapabilityMemories).toHaveBeenCalledTimes(1);
   });
 
   test("returns error for non-existent skill", async () => {
@@ -89,6 +130,7 @@ describe("delete_managed_skill tool", () => {
 
     expect(result.isError).toBe(true);
     expect(result.content).toContain("not found");
+    expect(mockRefreshSkillCapabilityMemories).not.toHaveBeenCalled();
   });
 
   test("rejects missing skill_id", async () => {

package/src/__tests__/disk-pressure-tools.test.ts

@@ -25,6 +25,7 @@ const mockConfig = {
     },
   },
   permissions: { mode: "workspace" as const },
+  tools: { exclude: [] },
 };
 
 mock.module("../config/loader.js", () => ({

package/src/__tests__/dm-backfill.test.ts

@@ -63,7 +63,10 @@ import { upsertContactChannel } from "../contacts/contacts-write.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import { messages } from "../memory/schema/conversations.js";
-import { readSlackMetadata } from "../messaging/providers/slack/message-metadata.js";
+import {
+  readSlackMetadata,
+  type SlackMessageMetadata,
+} from "../messaging/providers/slack/message-metadata.js";
 import { handleChannelInbound } from "./helpers/channel-test-adapter.js";
 
 initializeDb();
@@ -98,6 +101,18 @@ function seedActiveMember(): void {
   });
 }
 
+function seedSlackGuardian(): void {
+  upsertContactChannel({
+    sourceChannel: "slack",
+    externalUserId: SLACK_DM_USER_ID,
+    externalChatId: SLACK_DM_CHANNEL_ID,
+    status: "active",
+    policy: "allow",
+    displayName: SLACK_DM_DISPLAY_NAME,
+    role: "guardian",
+  });
+}
+
 let msgCounter = 0;
 
 function buildDmRequest(
@@ -136,7 +151,12 @@ function buildDmRequest(
 function readPersistedSlackRows(): Array<{
   role: string;
   content: string;
-  metadata: string | null;
+  rawContent: string;
+  slackMeta: SlackMessageMetadata | null;
+  provenanceTrustClass: string | undefined;
+  provenanceSourceChannel: string | undefined;
+  provenanceGuardianExternalUserId: string | undefined;
+  provenanceRequesterIdentifier: string | undefined;
 }> {
   const db = getDb();
   return db
@@ -146,7 +166,58 @@ function readPersistedSlackRows(): Array<{
       metadata: messages.metadata,
     })
     .from(messages)
-    .all();
+    .all()
+    .map((row) => {
+      let envelope: Record<string, unknown> = {};
+      if (row.metadata) {
+        try {
+          const parsed = JSON.parse(row.metadata) as unknown;
+          if (
+            parsed !== null &&
+            typeof parsed === "object" &&
+            !Array.isArray(parsed)
+          ) {
+            envelope = parsed as Record<string, unknown>;
+          }
+        } catch {
+          envelope = {};
+        }
+      }
+      const slackMeta =
+        typeof envelope.slackMeta === "string"
+          ? readSlackMetadata(envelope.slackMeta)
+          : null;
+      return {
+        role: row.role,
+        content: unwrapExternalContent(row.content),
+        rawContent: row.content,
+        slackMeta,
+        provenanceTrustClass:
+          typeof envelope.provenanceTrustClass === "string"
+            ? envelope.provenanceTrustClass
+            : undefined,
+        provenanceSourceChannel:
+          typeof envelope.provenanceSourceChannel === "string"
+            ? envelope.provenanceSourceChannel
+            : undefined,
+        provenanceGuardianExternalUserId:
+          typeof envelope.provenanceGuardianExternalUserId === "string"
+            ? envelope.provenanceGuardianExternalUserId
+            : undefined,
+        provenanceRequesterIdentifier:
+          typeof envelope.provenanceRequesterIdentifier === "string"
+            ? envelope.provenanceRequesterIdentifier
+            : undefined,
+      };
+    });
+}
+
+const EXTERNAL_CONTENT_WRAPPER =
+  /^<external_content[^>]*>\n([\s\S]*?)\n<\/external_content>$/;
+
+function unwrapExternalContent(content: string): string {
+  const match = content.match(EXTERNAL_CONTENT_WRAPPER);
+  return match ? match[1] : content;
 }
 
 function makeBackfilledMessage(overrides: Partial<Message> = {}): Message {
@@ -228,12 +299,15 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     expect(rows.length).toBe(3);
 
     const persistedTs = rows.map((r) => {
-      const envelope = JSON.parse(r.metadata!) as Record<string, unknown>;
-      const meta = readSlackMetadata(envelope.slackMeta as string);
+      const meta = r.slackMeta;
       expect(meta).not.toBeNull();
       expect(meta!.source).toBe("slack");
       expect(meta!.eventKind).toBe("message");
       expect(meta!.channelId).toBe(SLACK_DM_CHANNEL_ID);
+      expect(meta!.actorExternalUserId).toBe(SLACK_DM_USER_ID);
+      expect(r.provenanceTrustClass).toBe("unknown");
+      expect(r.provenanceSourceChannel).toBe("slack");
+      expect(r.provenanceRequesterIdentifier).toBe(SLACK_DM_USER_ID);
       return meta!.channelTs;
     });
     expect(new Set(persistedTs)).toEqual(
@@ -246,6 +320,36 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     expect(texts).toEqual(["older A", "older B", "older C"]);
   });
 
+  test("guardian DM backfill persists guardian text without external_content wrapping", async () => {
+    resetState();
+    seedSlackGuardian();
+
+    backfillDmMock.mockImplementation(async () => [
+      makeBackfilledMessage({
+        id: "1700000000.000001",
+        text: "trusted older context",
+        sender: { id: SLACK_DM_USER_ID, name: "Guardian Sender" },
+      }),
+    ]);
+
+    await handleChannelInbound(
+      buildDmRequest("live guardian DM"),
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
+
+    const [row] = readPersistedSlackRows();
+    expect(row).toBeDefined();
+    expect(row.role).toBe("user");
+    expect(row.rawContent).toBe("trusted older context");
+    expect(row.rawContent).not.toContain("<external_content");
+    expect(row.slackMeta?.actorExternalUserId).toBe(SLACK_DM_USER_ID);
+    expect(row.provenanceTrustClass).toBe("guardian");
+    expect(row.provenanceSourceChannel).toBe("slack");
+    expect(row.provenanceGuardianExternalUserId).toBe(SLACK_DM_USER_ID);
+    expect(row.provenanceRequesterIdentifier).toBe(SLACK_DM_USER_ID);
+  });
+
   test("warm storage prevents re-trigger on subsequent DMs", async () => {
     backfillDmMock.mockImplementation(async () => [
       makeBackfilledMessage({ id: "1700000000.000001", text: "older A" }),
@@ -352,10 +456,10 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     expect(texts).toEqual(["older A", "older B"]);
   });
 
-  test("bot-authored backfilled messages are persisted with role=assistant", async () => {
-    // Slack DM history includes our own prior bot replies. If those rows
-    // were rehydrated as `user` turns, the assistant would later treat its
-    // own output as new user input and speaker attribution would break.
+  test("bot-authored backfilled messages are persisted raw as user history", async () => {
+    // Backfilled Slack history is third-party channel replay. Even bot rows
+    // must not become `assistant` messages; that role is reserved for outputs
+    // produced by the local assistant loop.
     backfillDmMock.mockImplementation(async () => [
       makeBackfilledMessage({
         id: "1700000000.000001",
@@ -380,7 +484,14 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     expect(rows.length).toBe(2);
     const byText = new Map(rows.map((r) => [r.content, r.role]));
     expect(byText.get("user reply")).toBe("user");
-    expect(byText.get("assistant reply")).toBe("assistant");
+    expect(byText.get("assistant reply")).toBe("user");
+    const botRow = rows.find((r) => r.content === "assistant reply");
+    expect(botRow?.rawContent).toBe("assistant reply");
+    expect(botRow?.rawContent).not.toContain("<external_content");
+    expect(botRow?.slackMeta?.actorExternalUserId).toBe("B_BOT");
+    expect(botRow?.provenanceTrustClass).toBe("unknown");
+    expect(botRow?.provenanceSourceChannel).toBe("slack");
+    expect(botRow?.provenanceRequesterIdentifier).toBe("B_BOT");
   });
 
   test("backfill skips channelTs values already stored", async () => {

package/src/__tests__/document-tool-security.test.ts

@@ -0,0 +1,258 @@
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import { getDocumentById } from "../documents/document-store.js";
+import { getSqlite, resetDb } from "../memory/db-connection.js";
+import {
+  executeDocumentDelete,
+  executeDocumentList,
+  executeDocumentRead,
+  executeDocumentUpdate,
+} from "../tools/document/document-tool.js";
+import type { ToolContext, ToolExecutionResult } from "../tools/types.js";
+
+function makeContext(overrides: Partial<ToolContext> = {}): ToolContext {
+  return {
+    workingDir: "/tmp/project",
+    conversationId: "conv-current",
+    trustClass: "trusted_contact",
+    executionChannel: "slack",
+    ...overrides,
+  };
+}
+
+function parseResult<T>(result: ToolExecutionResult): T {
+  return JSON.parse(result.content) as T;
+}
+
+function bootstrapDocumentTables(): void {
+  resetDb();
+  const raw = getSqlite();
+  raw.exec(/*sql*/ `
+    DROP TABLE IF EXISTS document_conversations;
+    DROP TABLE IF EXISTS documents;
+    DROP TABLE IF EXISTS conversations;
+
+    CREATE TABLE conversations (
+      id TEXT PRIMARY KEY,
+      created_at INTEGER NOT NULL DEFAULT (strftime('%s','now') * 1000)
+    );
+
+    CREATE TABLE documents (
+      surface_id TEXT PRIMARY KEY,
+      conversation_id TEXT NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
+      title TEXT NOT NULL,
+      content TEXT NOT NULL,
+      word_count INTEGER NOT NULL DEFAULT 0,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+
+    CREATE TABLE document_conversations (
+      surface_id TEXT NOT NULL,
+      conversation_id TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      PRIMARY KEY (surface_id, conversation_id),
+      FOREIGN KEY (surface_id) REFERENCES documents(surface_id) ON DELETE CASCADE
+    );
+  `);
+}
+
+function seedDocument(params: {
+  surfaceId: string;
+  conversationId: string;
+  title: string;
+  content: string;
+  updatedAt: number;
+}): void {
+  const raw = getSqlite();
+  raw
+    .query(`INSERT OR IGNORE INTO conversations (id, created_at) VALUES (?, ?)`)
+    .run(params.conversationId, params.updatedAt);
+  raw
+    .query(
+      `INSERT INTO documents (surface_id, conversation_id, title, content, word_count, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)`,
+    )
+    .run(
+      params.surfaceId,
+      params.conversationId,
+      params.title,
+      params.content,
+      params.content.split(/\s+/).filter(Boolean).length,
+      params.updatedAt,
+      params.updatedAt,
+    );
+  raw
+    .query(
+      `INSERT OR IGNORE INTO document_conversations (surface_id, conversation_id, created_at) VALUES (?, ?, ?)`,
+    )
+    .run(params.surfaceId, params.conversationId, params.updatedAt);
+}
+
+function seedFixtureDocuments(): void {
+  seedDocument({
+    surfaceId: "doc-current",
+    conversationId: "conv-current",
+    title: "Current Business Plan",
+    content: "current plan",
+    updatedAt: 1000,
+  });
+  seedDocument({
+    surfaceId: "doc-other",
+    conversationId: "conv-other",
+    title: "Other Business Plan",
+    content: "other plan",
+    updatedAt: 2000,
+  });
+  seedDocument({
+    surfaceId: "doc-percent",
+    conversationId: "conv-other",
+    title: "100% Plan",
+    content: "literal percent",
+    updatedAt: 3000,
+  });
+}
+
+describe("document tool security", () => {
+  beforeEach(() => {
+    bootstrapDocumentTables();
+    seedFixtureDocuments();
+  });
+
+  test("scopes title search to the current conversation for non-guardian remote actors", () => {
+    const result = executeDocumentList(
+      { query: "Business Plan" },
+      makeContext({ trustClass: "trusted_contact", executionChannel: "slack" }),
+    );
+
+    const body = parseResult<{ documents: Array<{ surface_id: string }> }>(
+      result,
+    );
+    expect(body.documents.map((doc) => doc.surface_id)).toEqual([
+      "doc-current",
+    ]);
+  });
+
+  test("does not treat SQL LIKE wildcards as title-search wildcards", () => {
+    const result = executeDocumentList(
+      { query: "%" },
+      makeContext({ trustClass: "guardian", executionChannel: "telegram" }),
+    );
+
+    const body = parseResult<{ documents: Array<{ surface_id: string }> }>(
+      result,
+    );
+    expect(body.documents.map((doc) => doc.surface_id)).toEqual([
+      "doc-percent",
+    ]);
+  });
+
+  test("allows guardian and local actors to use documents from previous conversations", () => {
+    const guardianContext = makeContext({
+      trustClass: "guardian",
+      executionChannel: "telegram",
+      sendToClient: () => {},
+    });
+    const guardianList = executeDocumentList(
+      { query: "Other Business" },
+      guardianContext,
+    );
+    const guardianBody = parseResult<{
+      documents: Array<{ surface_id: string }>;
+    }>(guardianList);
+    expect(guardianBody.documents.map((doc) => doc.surface_id)).toEqual([
+      "doc-other",
+    ]);
+
+    const localRead = executeDocumentRead(
+      { surface_id: "doc-other" },
+      makeContext({ trustClass: "unknown", executionChannel: "vellum" }),
+    );
+    const localBody = parseResult<{
+      success: boolean;
+      surface_id: string;
+      content: string;
+    }>(localRead);
+    expect(localBody).toMatchObject({
+      success: true,
+      surface_id: "doc-other",
+      content: "other plan",
+    });
+
+    const guardianUpdate = executeDocumentUpdate(
+      { surface_id: "doc-other", content: "guardian edit", mode: "replace" },
+      guardianContext,
+    );
+    expect(guardianUpdate.isError).toBe(false);
+    expect(getDocumentById("doc-other")?.content).toBe("guardian edit");
+
+    const guardianDelete = executeDocumentDelete(
+      { surface_id: "doc-other" },
+      guardianContext,
+    );
+    expect(guardianDelete.isError).toBe(false);
+    expect(getDocumentById("doc-other")).toBeNull();
+  });
+
+  test("blocks cross-conversation read, update, and delete for non-guardian remote actors", () => {
+    const remoteContext = makeContext({
+      trustClass: "trusted_contact",
+      executionChannel: "slack",
+      sendToClient: () => {},
+    });
+
+    const read = executeDocumentRead(
+      { surface_id: "doc-other" },
+      remoteContext,
+    );
+    expect(read.isError).toBe(true);
+    expect(parseResult<{ error: string }>(read).error).toBe(
+      "Document not found",
+    );
+
+    const update = executeDocumentUpdate(
+      {
+        surface_id: "doc-other",
+        content: "updated by another conversation",
+        mode: "replace",
+      },
+      remoteContext,
+    );
+    expect(update.isError).toBe(true);
+    expect(getDocumentById("doc-other")?.content).toBe("other plan");
+
+    const deleted = executeDocumentDelete(
+      { surface_id: "doc-other" },
+      remoteContext,
+    );
+    expect(deleted.isError).toBe(true);
+    expect(getDocumentById("doc-other")).not.toBeNull();
+  });
+
+  test("keeps current-conversation documents editable and deletable", () => {
+    const remoteContext = makeContext({
+      trustClass: "trusted_contact",
+      executionChannel: "slack",
+      sendToClient: () => {},
+    });
+
+    const read = executeDocumentRead(
+      { surface_id: "doc-current" },
+      remoteContext,
+    );
+    expect(read.isError).toBe(false);
+
+    const update = executeDocumentUpdate(
+      { surface_id: "doc-current", content: "revised plan", mode: "replace" },
+      remoteContext,
+    );
+    expect(update.isError).toBe(false);
+    expect(getDocumentById("doc-current")?.content).toBe("revised plan");
+
+    const deleted = executeDocumentDelete(
+      { surface_id: "doc-current" },
+      remoteContext,
+    );
+    expect(deleted.isError).toBe(false);
+    expect(getDocumentById("doc-current")).toBeNull();
+  });
+});

package/src/__tests__/dynamic-skill-workflow-prompt.test.ts

@@ -74,7 +74,6 @@ describe("Dynamic Skill Authoring Workflow moved to tool descriptions", () => {
       join(skillsDir, "test-skill", "SKILL.md"),
       '---\nname: "Test Skill"\ndescription: "For testing."\n---\n\nDo testing.\n',
     );
-    writeFileSync(join(skillsDir, "SKILLS.md"), "- test-skill\n");
     writeFileSync(join(TEST_DIR, "IDENTITY.md"), "I am Vellum.");
 
     const result = buildSystemPrompt();

package/src/__tests__/edit-propagation.test.ts

@@ -19,6 +19,7 @@ mock.module("../util/logger.js", () => ({
 }));
 
 import { addMessage } from "../memory/conversation-crud.js";
+import { getConversationByKey } from "../memory/conversation-key-store.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import { linkMessage, recordInbound } from "../memory/delivery-crud.js";
@@ -160,6 +161,38 @@ describe("Slack edit propagation", () => {
     expect(slackMeta!.editedAt!).toBeGreaterThanOrEqual(t0);
   });
 
+  test("threaded Slack edits use the threaded conversation key and preserve thread metadata", async () => {
+    const conversationExternalId = "C0123CHANNEL";
+    const threadTs = "1234.0000";
+    const seeded = await seedSlackMessage({
+      conversationExternalId,
+      channelTs: "1234.5678",
+      initialContent: "original text",
+    });
+
+    const resp = await handleEditIntercept({
+      sourceChannel: "slack",
+      conversationExternalId,
+      externalMessageId: nextEditEventId(),
+      sourceMessageId: seeded.channelTs,
+      sourceThreadId: threadTs,
+      canonicalAssistantId: "self",
+      assistantId: "self",
+      content: "new text",
+    });
+
+    expect((resp as Record<string, unknown>).accepted).toBe(true);
+    const threadedKey = `asst:self:slack:${conversationExternalId}:thread:${threadTs}`;
+    const editConversation = getConversationByKey(threadedKey);
+    expect(editConversation).not.toBeNull();
+    expect(editConversation!.conversationId).not.toBe(seeded.conversationId);
+
+    const after = readMessageRow(seeded.messageId);
+    const outer = JSON.parse(after.metadata!) as Record<string, unknown>;
+    const slackMeta = readSlackMetadata(outer.slackMeta as string);
+    expect(slackMeta?.threadTs).toBe(threadTs);
+  });
+
   test("is idempotent across successive edits", async () => {
     const seeded = await seedSlackMessage({
       conversationExternalId: "C0123CHANNEL",

package/src/__tests__/empty-response-pipeline.test.ts

@@ -192,7 +192,6 @@ describe("emptyResponse pipeline — custom middleware overrides", () => {
       manifest: {
         name: "force-accept",
         version: "1.0.0",
-        requires: { pluginRuntime: "v1" },
       },
       middleware: {
         emptyResponse: async () => ({ action: "accept" }),
@@ -219,7 +218,6 @@ describe("emptyResponse pipeline — custom middleware overrides", () => {
       manifest: {
         name: "force-error",
         version: "1.0.0",
-        requires: { pluginRuntime: "v1" },
       },
       middleware: {
         emptyResponse: async () => ({ action: "error" }),
@@ -239,7 +237,6 @@ describe("emptyResponse pipeline — custom middleware overrides", () => {
       manifest: {
         name: "rewrite-nudge",
         version: "1.0.0",
-        requires: { pluginRuntime: "v1" },
       },
       middleware: {
         emptyResponse: async (args, next, ctx) => {
@@ -287,7 +284,6 @@ describe("emptyResponse pipeline — custom middleware overrides", () => {
       manifest: {
         name: "late-user-empty-response",
         version: "0.0.1",
-        requires: { pluginRuntime: "v1", emptyResponseApi: "v1" },
       },
       middleware: { emptyResponse: userMiddleware },
     });