@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/__tests__/schedule-routes.test.ts

@@ -18,6 +18,14 @@ mock.module("../config/loader.js", () => ({
       timezone: null,
     },
   }),
+  getConfigReadOnly: () => ({
+    llm: {
+      profiles: {
+        balanced: { model: "test-model" },
+        "cost-optimized": { model: "test-model-small" },
+      },
+    },
+  }),
   invalidateConfigCache: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
@@ -76,7 +84,7 @@ import { recordUsageEvent } from "../memory/llm-usage-store.js";
 import { rawRun } from "../memory/raw-query.js";
 import type { AssistantEvent } from "../runtime/assistant-event.js";
 import { assistantEventHub } from "../runtime/assistant-event-hub.js";
-import { BadRequestError } from "../runtime/routes/errors.js";
+import { BadRequestError, NotFoundError } from "../runtime/routes/errors.js";
 import { ROUTES as HEARTBEAT_ROUTES } from "../runtime/routes/heartbeat-routes.js";
 import { ROUTES as SCHEDULE_ROUTES } from "../runtime/routes/schedule-routes.js";
 import type { RouteDefinition } from "../runtime/routes/types.js";
@@ -587,6 +595,71 @@ describe("GET /schedules — default defer exclusion", () => {
   });
 });
 
+// ── GET /schedules/:id ────────────────────────────────────────────────────
+
+describe("GET /schedules/:id", () => {
+  beforeEach(() => {
+    clearTables();
+  });
+
+  test("returns the full schedule by ID", () => {
+    const source = createConversation("Schedule source");
+    const schedule = createSchedule({
+      name: "Single schedule",
+      description: "Fetch me by ID",
+      cronExpression: "0 9 * * *",
+      message: "review queue",
+      syntax: "cron",
+      createdFromConversationId: source.id,
+    });
+
+    const route = findRoute("schedules/:id", "GET");
+    const result = route.handler({ pathParams: { id: schedule.id } }) as {
+      schedule: Record<string, unknown>;
+    };
+
+    expect(result.schedule).toMatchObject({
+      id: schedule.id,
+      name: "Single schedule",
+      description: "Fetch me by ID",
+      cadenceDescription: "Every day at 9:00 AM",
+      message: "review queue",
+      mode: "execute",
+      enabled: true,
+      isOneShot: false,
+      createdFromConversationId: source.id,
+      createdFromConversationExists: true,
+      createdFromConversationArchivedAt: null,
+    });
+  });
+
+  test("returns deferred schedules that the list hides by default", () => {
+    const deferred = createSchedule({
+      name: "Deferred wake",
+      cronExpression: "0 9 * * *",
+      message: "wake up",
+      syntax: "cron",
+      createdBy: "defer",
+    });
+
+    const route = findRoute("schedules/:id", "GET");
+    const result = route.handler({ pathParams: { id: deferred.id } }) as {
+      schedule: { id: string };
+    };
+    expect(result.schedule.id).toBe(deferred.id);
+  });
+
+  test("throws NotFoundError for a missing schedule", () => {
+    const route = findRoute("schedules/:id", "GET");
+    expect(() =>
+      route.handler({ pathParams: { id: "missing-schedule" } }),
+    ).toThrow(NotFoundError);
+    expect(() =>
+      route.handler({ pathParams: { id: "missing-schedule" } }),
+    ).toThrow("Schedule not found");
+  });
+});
+
 // ── schedules/:id/runs limit handling ─────────────────────────────────────
 
 describe("schedule runs list — limit handling", () => {
@@ -1076,7 +1149,9 @@ describe("POST /schedules — create", () => {
 
   function postCreate(body: Record<string, unknown>) {
     const route = findRoute("schedules", "POST");
-    return route.handler({ body }) as { schedules: Array<{ id: string }> };
+    return route.handler({ body }) as {
+      schedules: Array<{ id: string; inferenceProfile: string | null }>;
+    };
   }
 
   test("creates a recurring execute schedule with defaults", () => {
@@ -1156,7 +1231,7 @@ describe("POST /schedules — create", () => {
     expect(job.description).toBe("Description fallback");
   });
 
-  test("rejects non-execute modes", () => {
+  test("rejects modes other than execute/workflow", () => {
     expect(() =>
       postCreate({
         name: "x",
@@ -1165,7 +1240,37 @@ describe("POST /schedules — create", () => {
         message: "hi",
         mode: "notify",
       }),
-    ).toThrow("Only 'execute' mode is supported");
+    ).toThrow("Only 'execute' and 'workflow' modes are supported");
+  });
+
+  test("rejects workflow-mode creation when the workflows flag is off", () => {
+    // The mocked getConfig returns no feature flags, so `workflows` is off.
+    expect(() =>
+      postCreate({
+        name: "Triage",
+        description: "Triage the inbox every morning",
+        expression: "0 9 * * *",
+        message: "triage inbox",
+        mode: "workflow",
+        workflowName: "triage-inbox",
+      }),
+    ).toThrow("Workflows are not enabled");
+  });
+
+  test("rejects PATCH switching to workflow mode when the flag is off", () => {
+    const schedule = createSchedule({
+      name: "Plain execute",
+      cronExpression: "0 9 * * *",
+      message: "hi",
+      syntax: "cron",
+    });
+    const patch = findRoute("schedules/:id", "PATCH");
+    expect(() =>
+      patch.handler({
+        pathParams: { id: schedule.id },
+        body: { mode: "workflow", workflowName: "triage-inbox" },
+      }),
+    ).toThrow("Workflows are not enabled");
   });
 
   test("rejects an unparseable expression", () => {
@@ -1190,6 +1295,38 @@ describe("POST /schedules — create", () => {
     ).toThrow();
   });
 
+  test("persists and round-trips workflowName/workflowArgs in the list response", () => {
+    // Store-level round trip: the create route is flag-gated (and the mocked
+    // config disables it), so exercise persistence directly via the store.
+    createSchedule({
+      name: "Workflow schedule",
+      cronExpression: "0 9 * * *",
+      message: "trigger",
+      syntax: "cron",
+      mode: "workflow",
+      workflowName: "triage-inbox",
+      workflowArgs: { folder: "primary", limit: 10 },
+    });
+
+    const route = findRoute("schedules", "GET");
+    const result = route.handler({}) as {
+      schedules: Array<{
+        name: string;
+        mode: string;
+        workflowName: string | null;
+      }>;
+    };
+    const job = result.schedules.find((s) => s.name === "Workflow schedule");
+    expect(job).toBeDefined();
+    expect(job!.mode).toBe("workflow");
+    expect(job!.workflowName).toBe("triage-inbox");
+
+    // workflowArgs is not in the list projection; assert it round-trips at the
+    // store layer (this is what the scheduler reads).
+    const stored = listSchedules().find((s) => s.name === "Workflow schedule")!;
+    expect(stored.workflowArgs).toEqual({ folder: "primary", limit: 10 });
+  });
+
   test("respects enabled=false", () => {
     postCreate({
       name: "Off",
@@ -1201,6 +1338,52 @@ describe("POST /schedules — create", () => {
     const job = listSchedules()[0];
     expect(job.enabled).toBe(false);
   });
+
+  test("persists a valid inferenceProfile and serializes it", () => {
+    const result = postCreate({
+      name: "Cheap digest",
+      description: "High-frequency digest on a cheap model",
+      expression: "0 * * * *",
+      message: "write the digest",
+      inferenceProfile: "cost-optimized",
+    });
+    expect(result.schedules[0].inferenceProfile).toBe("cost-optimized");
+    expect(listSchedules()[0].inferenceProfile).toBe("cost-optimized");
+  });
+
+  test("defaults inferenceProfile to null when omitted", () => {
+    const result = postCreate({
+      name: "Default profile",
+      description: "Runs on the main-agent selection",
+      expression: "0 9 * * *",
+      message: "hi",
+    });
+    expect(result.schedules[0].inferenceProfile).toBeNull();
+  });
+
+  test("rejects an unknown inferenceProfile", () => {
+    expect(() =>
+      postCreate({
+        name: "Bad profile",
+        description: "Unknown profile",
+        expression: "0 9 * * *",
+        message: "hi",
+        inferenceProfile: "does-not-exist",
+      }),
+    ).toThrow('Inference profile "does-not-exist" is not defined');
+  });
+
+  test("rejects a non-string inferenceProfile", () => {
+    expect(() =>
+      postCreate({
+        name: "Bad profile type",
+        description: "Wrong type",
+        expression: "0 9 * * *",
+        message: "hi",
+        inferenceProfile: 42,
+      }),
+    ).toThrow("inferenceProfile must be a string or null");
+  });
 });
 
 // ── PATCH /schedules/:id — description ───────────────────────────────────
@@ -1233,6 +1416,76 @@ describe("PATCH /schedules/:id — description", () => {
     });
     expect(listSchedules()[0].description).toBe("Updated description");
   });
+
+  test("sets, validates, and clears inferenceProfile", () => {
+    const schedule = createSchedule({
+      name: "Profile pin",
+      description: "Pinned profile schedule",
+      cronExpression: "0 9 * * *",
+      message: "hi",
+      syntax: "cron",
+    });
+    const route = findRoute("schedules/:id", "PATCH");
+
+    route.handler({
+      pathParams: { id: schedule.id },
+      body: { inferenceProfile: "balanced" },
+    });
+    expect(listSchedules()[0].inferenceProfile).toBe("balanced");
+
+    expect(() =>
+      route.handler({
+        pathParams: { id: schedule.id },
+        body: { inferenceProfile: "does-not-exist" },
+      }),
+    ).toThrow('Inference profile "does-not-exist" is not defined');
+    expect(listSchedules()[0].inferenceProfile).toBe("balanced");
+
+    route.handler({
+      pathParams: { id: schedule.id },
+      body: { inferenceProfile: null },
+    });
+    expect(listSchedules()[0].inferenceProfile).toBeNull();
+  });
+
+  test("re-derives syntax when the expression switches cron to rrule", () => {
+    const schedule = createSchedule({
+      name: "Syntax switch",
+      description: "Cron schedule",
+      cronExpression: "0 9 * * *",
+      message: "hi",
+      syntax: "cron",
+    });
+
+    const route = findRoute("schedules/:id", "PATCH");
+    const rrule = "DTSTART:20260101T000000Z\nRRULE:FREQ=WEEKLY;BYDAY=MO";
+    route.handler({
+      pathParams: { id: schedule.id },
+      body: { expression: rrule },
+    });
+
+    const updated = listSchedules()[0];
+    expect(updated.syntax).toBe("rrule");
+    expect(updated.cronExpression).toBe(rrule);
+  });
+
+  test("rejects an expression that parses as neither cron nor rrule", () => {
+    const schedule = createSchedule({
+      name: "Bad expression",
+      description: "Cron schedule",
+      cronExpression: "0 9 * * *",
+      message: "hi",
+      syntax: "cron",
+    });
+
+    const route = findRoute("schedules/:id", "PATCH");
+    expect(() =>
+      route.handler({
+        pathParams: { id: schedule.id },
+        body: { expression: "not a schedule" },
+      }),
+    ).toThrow(BadRequestError);
+  });
 });
 
 // ── Wake mode support ─────────────────────────────────────────────────────

package/src/__tests__/schedule-store.test.ts

@@ -1170,6 +1170,66 @@ describe("script timeout override", () => {
   });
 });
 
+// ── Capability manifest ─────────────────────────────────────────────
+
+describe("capability manifest", () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.run("DELETE FROM cron_runs");
+    db.run("DELETE FROM cron_jobs");
+  });
+
+  const manifest = {
+    tools: ["file_write"],
+    hostFunctions: [],
+    persona: false,
+  };
+
+  test("persists a capability manifest through create/read", () => {
+    const job = createSchedule({
+      name: "Capable schedule",
+      cronExpression: "0 9 * * *",
+      message: "do scoped work",
+      syntax: "cron",
+      capabilities: manifest,
+    });
+
+    expect(job.capabilities).toEqual(manifest);
+    expect(getSchedule(job.id)!.capabilities).toEqual(manifest);
+  });
+
+  test("defaults capabilities to null when not provided", () => {
+    const job = createSchedule({
+      name: "No manifest",
+      cronExpression: "0 9 * * *",
+      message: "unconstrained",
+      syntax: "cron",
+    });
+
+    expect(job.capabilities).toBeNull();
+    expect(getSchedule(job.id)!.capabilities).toBeNull();
+  });
+
+  test("updateSchedule sets and clears the capability manifest", () => {
+    const job = createSchedule({
+      name: "Update manifest",
+      cronExpression: "0 9 * * *",
+      message: "update manifest",
+      syntax: "cron",
+    });
+
+    expect(job.capabilities).toBeNull();
+
+    const updated = updateSchedule(job.id, { capabilities: manifest });
+    expect(updated!.capabilities).toEqual(manifest);
+    expect(getSchedule(job.id)!.capabilities).toEqual(manifest);
+
+    const cleared = updateSchedule(job.id, { capabilities: null });
+    expect(cleared!.capabilities).toBeNull();
+    expect(getSchedule(job.id)!.capabilities).toBeNull();
+  });
+});
+
 // ── listSchedules filters ───────────────────────────────────────────
 
 describe("listSchedules filters", () => {

package/src/__tests__/schedule-tools.test.ts

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -18,11 +18,18 @@ import type { Database } from "bun:sqlite";
 
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
+import { RiskLevel } from "../permissions/types.js";
+import {
+  __clearRegistryForTesting,
+  __resetRegistryForTesting,
+  registerTool,
+} from "../tools/registry.js";
 import { executeScheduleCreate as rawExecuteScheduleCreate } from "../tools/schedule/create.js";
 import { executeScheduleDelete } from "../tools/schedule/delete.js";
 import { executeScheduleList } from "../tools/schedule/list.js";
 import { executeScheduleUpdate } from "../tools/schedule/update.js";
-import type { ToolContext } from "../tools/types.js";
+import type { Tool, ToolContext } from "../tools/types.js";
+import { setOverridesForTesting } from "./feature-flag-test-helpers.js";
 
 initializeDb();
 
@@ -408,6 +415,244 @@ describe("schedule_create with mode and routing", () => {
   });
 });
 
+// ── schedule_create / schedule_update workflow mode ─────────────────
+
+describe("schedule tools — workflow mode", () => {
+  beforeEach(() => {
+    getRawDb().run("DELETE FROM cron_runs");
+    getRawDb().run("DELETE FROM cron_jobs");
+    setOverridesForTesting({ workflows: true });
+  });
+  afterAll(() => {
+    setOverridesForTesting({});
+  });
+
+  test("creates a workflow-mode schedule with workflow_name + workflow_args", async () => {
+    const result = await executeScheduleCreate(
+      {
+        name: "Morning triage",
+        expression: "0 8 * * *",
+        mode: "workflow",
+        workflow_name: "inbox-triage",
+        workflow_args: { limit: 50 },
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Mode: workflow");
+
+    const row = getRawDb()
+      .query(
+        "SELECT mode, workflow_name, workflow_args_json FROM cron_jobs LIMIT 1",
+      )
+      .get() as {
+      mode: string;
+      workflow_name: string;
+      workflow_args_json: string;
+    };
+    expect(row.mode).toBe("workflow");
+    expect(row.workflow_name).toBe("inbox-triage");
+    expect(JSON.parse(row.workflow_args_json)).toEqual({ limit: 50 });
+  });
+
+  test("rejects workflow mode without workflow_name", async () => {
+    const result = await executeScheduleCreate(
+      { name: "No wf name", expression: "0 8 * * *", mode: "workflow" },
+      ctx,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("workflow_name is required");
+  });
+
+  test("rejects workflow mode when the workflows flag is off", async () => {
+    setOverridesForTesting({}); // flag off
+    const result = await executeScheduleCreate(
+      {
+        name: "Flag off",
+        expression: "0 8 * * *",
+        mode: "workflow",
+        workflow_name: "inbox-triage",
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("workflows are not enabled");
+  });
+
+  test("update to workflow mode requires a workflow_name", async () => {
+    await executeScheduleCreate(
+      { name: "To workflow", expression: "0 9 * * *", message: "test" },
+      ctx,
+    );
+    const { id } = getRawDb()
+      .query("SELECT id FROM cron_jobs LIMIT 1")
+      .get() as { id: string };
+
+    const result = await executeScheduleUpdate(
+      { job_id: id, mode: "workflow" },
+      ctx,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("workflow_name is required");
+  });
+
+  test("updates a schedule into workflow mode with a workflow_name", async () => {
+    await executeScheduleCreate(
+      { name: "To workflow ok", expression: "0 9 * * *", message: "test" },
+      ctx,
+    );
+    const { id } = getRawDb()
+      .query("SELECT id FROM cron_jobs LIMIT 1")
+      .get() as { id: string };
+
+    const result = await executeScheduleUpdate(
+      { job_id: id, mode: "workflow", workflow_name: "nightly-report" },
+      ctx,
+    );
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Mode: workflow");
+    const dbRow = getRawDb()
+      .query("SELECT mode, workflow_name FROM cron_jobs WHERE id = ?")
+      .get(id) as { mode: string; workflow_name: string };
+    expect(dbRow.mode).toBe("workflow");
+    expect(dbRow.workflow_name).toBe("nightly-report");
+  });
+});
+
+// ── schedule_create workflow capability manifest ────────────────────
+
+describe("schedule_create — workflow capability manifest", () => {
+  function makeFakeTool(name: string): Tool {
+    return {
+      name,
+      description: `Fake ${name}`,
+      category: "test",
+      defaultRiskLevel: RiskLevel.Low,
+      executionTarget: "sandbox",
+      input_schema: { type: "object", properties: {}, required: [] },
+      async execute() {
+        return { content: "ok", isError: false };
+      },
+    };
+  }
+
+  beforeEach(() => {
+    getRawDb().run("DELETE FROM cron_runs");
+    getRawDb().run("DELETE FROM cron_jobs");
+    setOverridesForTesting({ workflows: true });
+    // Deterministic registry so a declared side-effecting tool resolves.
+    __clearRegistryForTesting();
+    registerTool(makeFakeTool("file_write"));
+  });
+  afterAll(() => {
+    setOverridesForTesting({});
+    __resetRegistryForTesting();
+  });
+
+  test("persists a validated side-effecting manifest verbatim", async () => {
+    const result = await executeScheduleCreate(
+      {
+        name: "Nightly writeback",
+        expression: "0 2 * * *",
+        mode: "workflow",
+        workflow_name: "nightly-report",
+        capabilities: { tools: ["file_write"], persona: true },
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(false);
+    const row = getRawDb()
+      .query("SELECT capabilities_json FROM cron_jobs LIMIT 1")
+      .get() as { capabilities_json: string };
+    expect(JSON.parse(row.capabilities_json)).toEqual({
+      tools: ["file_write"],
+      hostFunctions: [],
+      persona: true,
+    });
+  });
+
+  test("rejects a forbidden manifest at creation", async () => {
+    const result = await executeScheduleCreate(
+      {
+        name: "Recursion vector",
+        expression: "0 2 * * *",
+        mode: "workflow",
+        workflow_name: "nightly-report",
+        capabilities: { tools: ["run_workflow"] },
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("invalid capabilities manifest");
+    expect(getRawDb().query("SELECT id FROM cron_jobs").all()).toHaveLength(0);
+  });
+
+  test("rejects an unknown tool in the manifest at creation", async () => {
+    const result = await executeScheduleCreate(
+      {
+        name: "Bad tool",
+        expression: "0 2 * * *",
+        mode: "workflow",
+        workflow_name: "nightly-report",
+        capabilities: { tools: ["unknown_tool"] },
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("invalid capabilities manifest");
+    expect(getRawDb().query("SELECT id FROM cron_jobs").all()).toHaveLength(0);
+  });
+
+  test("a read-only manifest persists as a baseline grant", async () => {
+    const result = await executeScheduleCreate(
+      {
+        name: "Read-only run",
+        expression: "0 2 * * *",
+        mode: "workflow",
+        workflow_name: "nightly-report",
+        capabilities: { tools: [], hostFunctions: [], persona: false },
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(false);
+    const row = getRawDb()
+      .query("SELECT capabilities_json FROM cron_jobs LIMIT 1")
+      .get() as { capabilities_json: string };
+    expect(JSON.parse(row.capabilities_json)).toEqual({
+      tools: [],
+      hostFunctions: [],
+      persona: false,
+    });
+  });
+
+  test("an absent manifest persists no capabilities", async () => {
+    const result = await executeScheduleCreate(
+      {
+        name: "No manifest",
+        expression: "0 2 * * *",
+        mode: "workflow",
+        workflow_name: "nightly-report",
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(false);
+    const row = getRawDb()
+      .query("SELECT capabilities_json FROM cron_jobs LIMIT 1")
+      .get() as { capabilities_json: string | null };
+    expect(row.capabilities_json).toBeNull();
+  });
+});
+
 // ── script timeout override ─────────────────────────────────────────
 
 describe("schedule_create / schedule_update timeout_ms", () => {