@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.8.12",
+  "version": "0.9.0-staging.2",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -36,6 +36,7 @@
     "@agentclientprotocol/sdk": "0.25.0",
     "@anthropic-ai/sdk": "0.78.0",
     "@google/genai": "1.45.0",
+    "@jitl/quickjs-singlefile-mjs-release-asyncify": "0.32.0",
     "@modelcontextprotocol/sdk": "1.27.1",
     "@qdrant/js-client-rest": "1.17.0",
     "@resvg/resvg-js": "2.6.2",
@@ -60,16 +61,18 @@
     "openai": "6.29.0",
     "pino": "9.14.0",
     "pino-pretty": "13.1.3",
-    "semver": "7.8.0",
     "playwright": "1.58.2",
     "postgres": "3.4.8",
+    "quickjs-emscripten": "0.32.0",
     "rrule": "2.8.1",
+    "semver": "7.8.0",
     "stemmer": "2.0.1",
     "tar-stream": "3.1.7",
     "tldts": "7.0.25",
     "uuid": "11.1.0",
     "yaml": "2.8.2",
-    "zod": "4.3.6"
+    "zod": "4.3.6",
+    "zod-openapi": "5.4.6"
   },
   "engines": {
     "node": ">=20.12.0"
@@ -100,7 +103,8 @@
     "@types/node": "25.5.0",
     "@types/semver": "7.5.8",
     "@types/uuid": "10.0.0",
-    "drizzle-kit": "0.30.6",
+    "ajv": "8.18.0",
+    "drizzle-kit": "0.31.10",
     "eslint": "10.0.3",
     "eslint-plugin-simple-import-sort": "12.1.1",
     "fast-check": "4.6.0",

package/scripts/generate-openapi.ts

@@ -19,10 +19,16 @@
 import { readFileSync } from "node:fs";
 import { readdir, readFile, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
-import { Readable } from "node:stream";
 
 import { stringify } from "yaml";
 import { z } from "zod";
+import type {
+  oas31,
+  ZodOpenApiOperationObject,
+  ZodOpenApiPathsObject,
+  ZodOpenApiResponseObject,
+} from "zod-openapi";
+import { createDocument } from "zod-openapi";
 
 const ROOT = resolve(import.meta.dir, "..");
 const ROUTES_DIR = join(ROOT, "src/runtime/routes");
@@ -46,13 +52,13 @@ const RouteQueryParamSchema = z.object({
  * JSON-Schema-style object for backward compatibility with inline routes.
  */
 const RouteBodySchemaSchema = z.any().refine(
-  (v) =>
+  (v): v is z.ZodType | oas31.SchemaObject =>
     v != null &&
     typeof v === "object" &&
     // Zod schema instance (Zod 4 uses _zod branded property)
     ("_zod" in v ||
       // Plain JSON Schema fallback
-      typeof (v as Record<string, unknown>).type === "string"),
+      "type" in v),
   { message: "Expected a Zod schema or a plain JSON Schema object" },
 );
 
@@ -111,67 +117,29 @@ const RouteEntrySchema = z.object({
 
 type RouteEntry = z.infer<typeof RouteEntrySchema>;
 
-/** JSON Schema representation of a body (for the OpenAPI spec output). */
-interface JSONSchemaObject {
-  type?: string;
-  properties?: Record<string, unknown>;
-  required?: string[];
-  description?: string;
-  additionalProperties?: boolean;
-  [key: string]: unknown;
-}
+type ContentSchema = z.ZodType | oas31.SchemaObject;
 
-/**
- * Recursively strip fields with a `default` from `required[]` on every
- * object schema in the tree. Zod 4's `toJSONSchema` (output mode) marks
- * defaulted fields as required because the output always carries them,
- * but for request bodies the server fills the default when the client
- * omits the field — generated clients should not be forced to send it.
- */
-function dropDefaultedFromRequired(node: unknown): void {
-  if (node == null || typeof node !== "object") return;
-  if (Array.isArray(node)) {
-    for (const item of node) dropDefaultedFromRequired(item);
-    return;
-  }
-  const obj = node as Record<string, unknown>;
-  const props = obj.properties;
-  const required = obj.required;
-  if (Array.isArray(required) && props != null && typeof props === "object") {
-    const propsRecord = props as Record<string, unknown>;
-    const filtered = required.filter((name) => {
-      if (typeof name !== "string") return true;
-      const prop = propsRecord[name];
-      return !(
-        prop != null &&
-        typeof prop === "object" &&
-        "default" in (prop as Record<string, unknown>)
-      );
-    });
-    if (filtered.length > 0) obj.required = filtered;
-    else delete obj.required;
+type HttpStatusCode = `${1 | 2 | 3 | 4 | 5}${string}`;
+
+function toHttpStatus(status: string): HttpStatusCode {
+  if (!/^[1-5]\d{2}$/.test(status)) {
+    throw new Error(`Invalid HTTP status code: ${status}`);
   }
-  for (const value of Object.values(obj)) dropDefaultedFromRequired(value);
+  return status as HttpStatusCode;
 }
 
-/** Convert a Zod schema or plain JSON Schema object to a JSON Schema object. */
-function toJSONSchemaObject(
-  schema: unknown,
-  options: { stripRequiredDefaults?: boolean } = {},
-): JSONSchemaObject {
-  if (schema == null || typeof schema !== "object") return {};
-  // Zod schema: has _zod branded property
-  if ("_zod" in (schema as Record<string, unknown>)) {
-    const converted = z.toJSONSchema(schema as z.ZodType, {
-      unrepresentable: "any",
-    });
-    // z.toJSONSchema may add $schema — strip it for inline embedding
-    const { $schema: _, ...rest } = converted as Record<string, unknown>;
-    if (options.stripRequiredDefaults) dropDefaultedFromRequired(rest);
-    return rest as JSONSchemaObject;
+/**
+ * Resolve a schema source to a value suitable for zod-openapi's
+ * `schema` field. If it's a Zod schema, pass it through directly (so
+ * createDocument can extract components and produce $ref pointers).
+ * For plain JSON Schema objects (backward compat), pass as-is —
+ * createDocument accepts SchemaObject too.
+ */
+function resolveSchemaForDocument(schemaSource: unknown): ContentSchema {
+  if (schemaSource == null || typeof schemaSource !== "object") {
+    return { type: "object" } satisfies oas31.SchemaObject;
   }
-  // Plain JSON Schema object (backward compat for inline/pre-auth routes)
-  return schema as JSONSchemaObject;
+  return schemaSource as ContentSchema;
 }
 
 // ---------------------------------------------------------------------------
@@ -302,46 +270,26 @@ interface OpenApiParameter {
   description?: string;
 }
 
-interface OpenApiResponse {
-  description: string;
-  content?: Record<string, { schema: JSONSchemaObject }>;
-}
-
-interface OpenApiOperation {
-  operationId: string;
-  summary?: string;
-  description?: string;
-  tags?: string[];
-  parameters?: OpenApiParameter[];
-  requestBody?: {
-    required: boolean;
-    content: Record<string, { schema: JSONSchemaObject }>;
-  };
-  responses: Record<string, OpenApiResponse>;
-}
-
 /**
  * Resolve a body declaration (request or success response) into its media type
  * and the schema source to convert. A bare Zod/JSON schema is advertised as
  * `application/json`; the explicit `{ contentType, schema }` form carries its
  * own media type (e.g. `application/octet-stream` for binary bodies).
  */
+function hasContentType(
+  body: unknown,
+): body is { contentType: string; schema: unknown } {
+  return typeof body === "object" && body !== null && "contentType" in body;
+}
+
 function resolveBodyContent(body: unknown): {
   contentType: string;
   schemaSource: unknown;
 } {
-  const hasContentType =
-    typeof body === "object" && body !== null && "contentType" in body;
-  return {
-    contentType: hasContentType
-      ? (body as { contentType: string }).contentType
-      : "application/json",
-    schemaSource: hasContentType ? (body as { schema: unknown }).schema : body,
-  };
-}
-
-interface OpenApiPathItem {
-  [method: string]: OpenApiOperation;
+  if (hasContentType(body)) {
+    return { contentType: body.contentType, schemaSource: body.schema };
+  }
+  return { contentType: "application/json", schemaSource: body };
 }
 
 /** Derive a tag name from a route module filename (e.g. "secret-routes.ts" → "secrets"). */
@@ -401,14 +349,22 @@ function buildSpec(
     return a.method.localeCompare(b.method);
   });
 
-  // Build paths object
-  const paths: Record<string, OpenApiPathItem> = {};
+  // Build paths object for zod-openapi's createDocument
+  const paths: ZodOpenApiPathsObject = {};
   for (const route of uniqueRoutes) {
     if (!paths[route.path]) {
       paths[route.path] = {};
     }
 
-    const methodLower = route.method.toLowerCase();
+    const methodLower = route.method.toLowerCase() as
+      | "get"
+      | "post"
+      | "put"
+      | "patch"
+      | "delete"
+      | "options"
+      | "head"
+      | "trace";
     const operationId = route.path.startsWith("/v1/")
       ? toOperationId(route.endpoint, route.method)
       : route.path.replace(/^\//, "").replace(/[/{}\-]/g, "_") +
@@ -448,8 +404,8 @@ function buildSpec(
     // Build the operation. Default success status is 200; async endpoints
     // that enqueue a job and return immediately set responseStatus: "202"
     // so the generated spec matches the handler's actual response code.
-    const successStatus = entry.responseStatus ?? "200";
-    let successResponse: OpenApiResponse = {
+    const successStatus = toHttpStatus(entry.responseStatus ?? "200");
+    let successResponse: ZodOpenApiResponseObject = {
       description: "Successful response",
     };
     if (entry.responseBody) {
@@ -459,11 +415,13 @@ function buildSpec(
       successResponse = {
         description: "Successful response",
         content: {
-          [contentType]: { schema: toJSONSchemaObject(schemaSource) },
+          [contentType]: {
+            schema: resolveSchemaForDocument(schemaSource),
+          },
         },
       };
     }
-    const operation: OpenApiOperation = {
+    const operation: ZodOpenApiOperationObject = {
       operationId,
       ...(entry.summary ? { summary: entry.summary } : {}),
       ...(entry.description ? { description: entry.description } : {}),
@@ -477,10 +435,6 @@ function buildSpec(
       operation.parameters = parameters;
     }
 
-    // A bare Zod/JSON schema is advertised as `application/json`; the
-    // explicit `{ contentType, schema }` form lets a route declare a non-JSON
-    // body (e.g. a raw `application/octet-stream` upload) so the generated SDK
-    // describes a real body type instead of `never`.
     if (entry.requestBody) {
       const { contentType, schemaSource } = resolveBodyContent(
         entry.requestBody,
@@ -489,9 +443,7 @@ function buildSpec(
         required: true,
         content: {
           [contentType]: {
-            schema: toJSONSchemaObject(schemaSource, {
-              stripRequiredDefaults: true,
-            }),
+            schema: resolveSchemaForDocument(schemaSource),
           },
         },
       };
@@ -500,13 +452,13 @@ function buildSpec(
     // Extra documented response variants (e.g. 502 fetch_failed).
     if (entry.additionalResponses) {
       for (const [status, resp] of Object.entries(entry.additionalResponses)) {
-        operation.responses[status] = {
+        operation.responses[toHttpStatus(status)] = {
           description: resp.description,
           ...(resp.schema
             ? {
                 content: {
                   "application/json": {
-                    schema: toJSONSchemaObject(resp.schema),
+                    schema: resolveSchemaForDocument(resp.schema),
                   },
                 },
               }
@@ -518,7 +470,7 @@ function buildSpec(
     paths[route.path][methodLower] = operation;
   }
 
-  return {
+  return createDocument({
     openapi: "3.1.0",
     info: {
       title: "Vellum Assistant API",
@@ -533,7 +485,7 @@ function buildSpec(
       },
     ],
     paths,
-  };
+  });
 }
 
 // ---------------------------------------------------------------------------
@@ -563,10 +515,8 @@ async function main() {
     stringify(spec, { lineWidth: 120 });
 
   // Format with prettier so the output matches what the pre-commit hook produces.
-  // Use a Node.js Readable stream for stdin — Bun.spawn with Blob stdin produces
-  // empty output on some platforms (Bun 1.3.x Linux sandbox).
   const prettierProc = Bun.spawn(["bunx", "prettier", "--parser", "yaml"], {
-    stdin: Readable.from([rawYaml]) as unknown as Blob,
+    stdin: new Blob([rawYaml]),
     stdout: "pipe",
     stderr: "pipe",
   });
@@ -661,10 +611,12 @@ async function main() {
   await writeFile(OUTPUT_PATH, yamlOutput);
 
   // Count stats
-  const pathCount = Object.keys(spec.paths as Record<string, unknown>).length;
-  const operationCount = Object.values(
-    spec.paths as Record<string, Record<string, unknown>>,
-  ).reduce((n, methods) => n + Object.keys(methods).length, 0);
+  const paths = spec.paths ?? {};
+  const pathCount = Object.keys(paths).length;
+  const operationCount = Object.values(paths).reduce(
+    (n, methods) => n + Object.keys(methods ?? {}).length,
+    0,
+  );
 
   console.log(`Generated ${OUTPUT_PATH}`);
   console.log(`  ${pathCount} paths, ${operationCount} operations`);

package/src/__tests__/access-request-seed-content-blocks.test.ts

@@ -0,0 +1,213 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  buildAccessRequestSeedContentBlocks,
+  parseAccessRequestPayload,
+} from "../notifications/access-request-copy.js";
+
+describe("buildAccessRequestSeedContentBlocks", () => {
+  const basePayload: Record<string, unknown> = {
+    requestId: "req-123",
+    requestCode: "ABC123",
+    sourceChannel: "slack",
+    conversationExternalId: "C01ABC",
+    actorExternalId: "U999",
+    actorDisplayName: "Alice",
+    actorUsername: "alice",
+    senderIdentifier: "U999",
+    messagePreview: "Hello, I need help with something",
+    messageTs: "1700000000.000100",
+  };
+
+  test("produces a ui_surface block and a text fallback block", () => {
+    const blocks = buildAccessRequestSeedContentBlocks(basePayload);
+    expect(blocks).toHaveLength(2);
+    expect((blocks[0] as Record<string, unknown>).type).toBe("ui_surface");
+    expect((blocks[1] as Record<string, unknown>).type).toBe("text");
+  });
+
+  test("card surface has correct surfaceType and surfaceId", () => {
+    const blocks = buildAccessRequestSeedContentBlocks(basePayload);
+    const surface = blocks[0] as Record<string, unknown>;
+    expect(surface.surfaceType).toBe("card");
+    expect(surface.surfaceId).toBe("access-request-req-123");
+    expect(surface.title).toBe("Access Request");
+  });
+
+  test("card data uses actorDisplayName as title", () => {
+    const blocks = buildAccessRequestSeedContentBlocks(basePayload);
+    const surface = blocks[0] as Record<string, unknown>;
+    const data = surface.data as Record<string, unknown>;
+    expect(data.title).toBe("Alice");
+    expect(data.subtitle).toBe("Requesting access to the assistant");
+  });
+
+  test("card data falls back to senderIdentifier when no displayName", () => {
+    const payload = { ...basePayload, actorDisplayName: undefined };
+    const blocks = buildAccessRequestSeedContentBlocks(payload);
+    const data = (blocks[0] as Record<string, unknown>).data as Record<
+      string,
+      unknown
+    >;
+    expect(data.title).toBe("U999");
+  });
+
+  test("card data falls back to 'Someone' when no identity", () => {
+    const payload = {
+      ...basePayload,
+      actorDisplayName: undefined,
+      senderIdentifier: undefined,
+    };
+    const blocks = buildAccessRequestSeedContentBlocks(payload);
+    const data = (blocks[0] as Record<string, unknown>).data as Record<
+      string,
+      unknown
+    >;
+    expect(data.title).toBe("Someone");
+  });
+
+  test("includes username and source in metadata", () => {
+    const blocks = buildAccessRequestSeedContentBlocks(basePayload);
+    const data = (blocks[0] as Record<string, unknown>).data as Record<
+      string,
+      unknown
+    >;
+    const metadata = data.metadata as Array<{ label: string; value: string }>;
+    expect(metadata).toContainEqual({
+      label: "Username",
+      value: "@alice",
+    });
+    expect(metadata).toContainEqual({
+      label: "Source",
+      value: "Slack — #C01ABC",
+    });
+  });
+
+  test("DM channel renders as Direct message", () => {
+    const payload = { ...basePayload, conversationExternalId: "D01XYZ" };
+    const blocks = buildAccessRequestSeedContentBlocks(payload);
+    const data = (blocks[0] as Record<string, unknown>).data as Record<
+      string,
+      unknown
+    >;
+    const metadata = data.metadata as Array<{ label: string; value: string }>;
+    expect(metadata).toContainEqual({
+      label: "Source",
+      value: "Slack — Direct message",
+    });
+  });
+
+  test("body includes message preview when present", () => {
+    const blocks = buildAccessRequestSeedContentBlocks(basePayload);
+    const data = (blocks[0] as Record<string, unknown>).data as Record<
+      string,
+      unknown
+    >;
+    expect(data.body).toContain("Hello, I need help with something");
+  });
+
+  test("body includes trust signal warnings", () => {
+    const payload = {
+      ...basePayload,
+      isStranger: true,
+      isRestricted: true,
+      previousMemberStatus: "revoked",
+    };
+    const blocks = buildAccessRequestSeedContentBlocks(payload);
+    const data = (blocks[0] as Record<string, unknown>).data as Record<
+      string,
+      unknown
+    >;
+    const body = data.body as string;
+    expect(body).toContain("External Slack user");
+    expect(body).toContain("Guest / restricted account");
+    expect(body).toContain("previously revoked");
+  });
+
+  test("body includes Slack message permalink", () => {
+    const blocks = buildAccessRequestSeedContentBlocks(basePayload);
+    const data = (blocks[0] as Record<string, unknown>).data as Record<
+      string,
+      unknown
+    >;
+    const body = data.body as string;
+    expect(body).toContain("View message");
+    expect(body).toContain(
+      "https://slack.com/archives/C01ABC/p1700000000000100",
+    );
+  });
+
+  test("text fallback block contains contract text", () => {
+    const blocks = buildAccessRequestSeedContentBlocks(basePayload);
+    const textBlock = blocks[1] as Record<string, unknown>;
+    expect(textBlock.type).toBe("text");
+    const text = textBlock.text as string;
+    expect(text).toContain("requesting access to the assistant");
+    expect(text).toContain("ABC123");
+  });
+
+  test("body shows fallback when no preview/warnings/permalink", () => {
+    const payload = {
+      requestId: "req-456",
+      requestCode: "XYZ",
+      senderIdentifier: "someone",
+    };
+    const blocks = buildAccessRequestSeedContentBlocks(payload);
+    const data = (blocks[0] as Record<string, unknown>).data as Record<
+      string,
+      unknown
+    >;
+    expect(data.body).toBe("No additional context available.");
+  });
+
+  test("surface block includes approve/reject actions when requestId present", () => {
+    const blocks = buildAccessRequestSeedContentBlocks(basePayload);
+    const surface = blocks[0] as Record<string, unknown>;
+    const actions = surface.actions as Array<{
+      id: string;
+      label: string;
+      style: string;
+    }>;
+    expect(actions).toHaveLength(2);
+    expect(actions[0]).toEqual({
+      id: "apr:req-123:approve_once",
+      label: "Approve",
+      style: "primary",
+    });
+    expect(actions[1]).toEqual({
+      id: "apr:req-123:reject",
+      label: "Reject",
+      style: "destructive",
+    });
+  });
+
+  test("surface block omits actions when requestId is missing", () => {
+    const payload = {
+      ...basePayload,
+      requestId: undefined,
+    };
+    const blocks = buildAccessRequestSeedContentBlocks(payload);
+    const surface = blocks[0] as Record<string, unknown>;
+    expect(surface.actions).toBeUndefined();
+  });
+
+  test("parseAccessRequestPayload extracts typed fields", () => {
+    const p = parseAccessRequestPayload(basePayload);
+    expect(p.requestId).toBe("req-123");
+    expect(p.actorDisplayName).toBe("Alice");
+    expect(p.actorUsername).toBe("alice");
+    expect(p.sourceChannel).toBe("slack");
+    expect(p.isStranger).toBeUndefined();
+    expect(p.isRestricted).toBeUndefined();
+  });
+
+  test("parseAccessRequestPayload handles boolean trust signals", () => {
+    const p = parseAccessRequestPayload({
+      ...basePayload,
+      isStranger: true,
+      isRestricted: true,
+    });
+    expect(p.isStranger).toBe(true);
+    expect(p.isRestricted).toBe(true);
+  });
+});

package/src/__tests__/adaptive-thinking-repair.test.ts

@@ -11,6 +11,7 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
 import { repairAdaptiveThinkingOnManagedProfiles } from "../workspace/adaptive-thinking-repair.js";
 import { enableAdaptiveThinkingManagedProfilesMigration } from "../workspace/migrations/097-enable-adaptive-thinking-managed-profiles.js";
+import { recheckAdaptiveThinkingModelImpliedAnthropicMigration } from "../workspace/migrations/104-recheck-adaptive-thinking-model-implied-anthropic.js";
 
 const ADAPTIVE = { enabled: true, streamThinking: true };
 
@@ -48,15 +49,19 @@ function profile(name: string): Record<string, unknown> {
   return profiles[name] as Record<string, unknown>;
 }
 
-// The startup repair and migration 097 keep frozen copies of the same logic
-// (migration modules must stay self-contained). Run every scenario against
-// both so the copies can't drift.
+// The startup repair, migration 097, and migration 104 keep frozen copies of
+// the same logic (migration modules must stay self-contained). Run every
+// scenario against all of them so the copies can't drift.
 const implementations: Array<[string, (dir: string) => void]> = [
   ["startup repair", repairAdaptiveThinkingOnManagedProfiles],
   [
     "migration 097",
     (dir) => enableAdaptiveThinkingManagedProfilesMigration.run(dir),
   ],
+  [
+    "migration 104",
+    (dir) => recheckAdaptiveThinkingModelImpliedAnthropicMigration.run(dir),
+  ],
 ];
 
 describe.each(implementations)("%s", (_label, run) => {
@@ -131,6 +136,30 @@ describe.each(implementations)("%s", (_label, run) => {
     expect(profile("balanced").thinking).toEqual(ADAPTIVE);
   });
 
+  test("patches source-less profiles pinning a known Claude model under a non-Anthropic default", () => {
+    // A managed/source-less profile that omits `provider` but pins a known
+    // Claude model is Anthropic via the resolver's model-implied provider, even
+    // when llm.default.provider is non-Anthropic. It must still get adaptive
+    // thinking rather than being skipped.
+    writeConfig({
+      llm: {
+        default: { provider: "gemini", model: "gemini-2.5-pro" },
+        profiles: {
+          balanced: { model: "claude-sonnet-4-6" },
+          "quality-optimized": {
+            source: "managed",
+            model: "claude-opus-4-8",
+          },
+        },
+      },
+    });
+
+    run(workspaceDir);
+
+    expect(profile("balanced").thinking).toEqual(ADAPTIVE);
+    expect(profile("quality-optimized").thinking).toEqual(ADAPTIVE);
+  });
+
   test("skips profiles with an explicit non-Anthropic provider", () => {
     writeConfig({
       llm: {