@vellumai/assistant 0.8.5 → 0.8.6

package/src/runtime/routes/__tests__/surface-content-routes.test.ts

@@ -0,0 +1,294 @@
+/**
+ * Tests for the surface-content route handler.
+ *
+ * Focus is the rehydrate-on-miss path: after daemon restart or LRU
+ * eviction, the in-memory conversation map is empty even though the
+ * surface still persists as a `ui_surface` content block in the
+ * messages table. The handler must fall back to a DB scan via the
+ * shared `resolveSurfaceConversation` helper, which calls
+ * `getOrCreateConversation` to rehydrate the conversation. The
+ * rehydration runs `restoreSurfaceStateFromHistory()` in production,
+ * which is what repopulates the surfaceState the handler then reads
+ * from — in tests we simulate the rehydrated conversation by stubbing
+ * `getOrCreateConversation`'s return value with pre-populated
+ * `surfaceState`.
+ *
+ * Strategy mirrors `surface-action-routes.test.ts`: mock the
+ * `conversation-store` and `raw-query` modules at their boundary so
+ * the resolver code path executes against the test doubles, import
+ * ROUTES afterwards, and dispatch by operationId.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Mock state
+// ---------------------------------------------------------------------------
+
+interface StoredSurface {
+  surfaceType: string;
+  title: string | null;
+  data: Record<string, unknown>;
+}
+
+interface StubConversation {
+  id: string;
+  surfaceState: Map<string, StoredSurface>;
+  currentTurnSurfaces?: Array<{
+    surfaceId: string;
+    surfaceType: string;
+    title?: string | null;
+    data: Record<string, unknown>;
+  }>;
+}
+
+let memoryById: StubConversation | null = null;
+let rehydrated: StubConversation | null = null;
+let rawGetReturn: { conversation_id: string } | null = null;
+
+const findConvCalls: string[] = [];
+const findBySurfaceCalls: string[] = [];
+const getOrCreateCalls: string[] = [];
+const rawGetCalls: Array<{ sql: string; params: unknown[] }> = [];
+
+mock.module("../../../daemon/conversation-store.js", () => ({
+  findConversation: (id: string) => {
+    findConvCalls.push(id);
+    return memoryById ?? undefined;
+  },
+  findConversationBySurfaceId: (surfaceId: string) => {
+    findBySurfaceCalls.push(surfaceId);
+    return undefined;
+  },
+  getOrCreateConversation: async (id: string) => {
+    getOrCreateCalls.push(id);
+    if (!rehydrated) {
+      throw new Error(
+        `getOrCreateConversation(${id}) called but no rehydrated stub configured`,
+      );
+    }
+    return rehydrated;
+  },
+}));
+
+mock.module("../../../memory/raw-query.js", () => ({
+  rawGet: (sql: string, ...params: unknown[]) => {
+    rawGetCalls.push({ sql, params });
+    return rawGetReturn;
+  },
+}));
+
+// Defer route import until after mocks are installed.
+const { ROUTES } = await import("../surface-content-routes.js");
+const { BadRequestError, NotFoundError } = await import("../errors.js");
+import type { RouteDefinition } from "../types.js";
+
+function findHandler(operationId: string): RouteDefinition["handler"] {
+  const route = ROUTES.find((r) => r.operationId === operationId);
+  if (!route) throw new Error(`Route ${operationId} not found`);
+  return route.handler;
+}
+
+function makeStub(id: string): StubConversation {
+  return { id, surfaceState: new Map() };
+}
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+beforeEach(() => {
+  memoryById = null;
+  rehydrated = null;
+  rawGetReturn = null;
+  findConvCalls.length = 0;
+  findBySurfaceCalls.length = 0;
+  getOrCreateCalls.length = 0;
+  rawGetCalls.length = 0;
+});
+
+// ---------------------------------------------------------------------------
+// surfaces_get_content
+// ---------------------------------------------------------------------------
+
+describe("surfaces_get_content handler", () => {
+  test("serves surface from in-memory surfaceState", async () => {
+    const conv = makeStub("conv-active");
+    conv.surfaceState.set("surf-1", {
+      surfaceType: "card",
+      title: "T",
+      data: { foo: "bar" },
+    });
+    memoryById = conv;
+
+    const handler = findHandler("surfaces_get_content");
+    const result = await handler({
+      pathParams: { surfaceId: "surf-1" },
+      queryParams: { conversationId: "conv-active" },
+    });
+
+    expect(result).toEqual({
+      surfaceId: "surf-1",
+      surfaceType: "card",
+      title: "T",
+      data: { foo: "bar" },
+    });
+    expect(findConvCalls).toEqual(["conv-active"]);
+    // Fast path — never touched the DB or rehydration helpers.
+    expect(rawGetCalls).toEqual([]);
+    expect(getOrCreateCalls).toEqual([]);
+  });
+
+  test("falls back to currentTurnSurfaces when surfaceState misses", async () => {
+    const conv = makeStub("conv-mid-turn");
+    conv.currentTurnSurfaces = [
+      {
+        surfaceId: "surf-pending",
+        surfaceType: "list",
+        title: "Picks",
+        data: { items: [] },
+      },
+    ];
+    memoryById = conv;
+
+    const handler = findHandler("surfaces_get_content");
+    const result = await handler({
+      pathParams: { surfaceId: "surf-pending" },
+      queryParams: { conversationId: "conv-mid-turn" },
+    });
+
+    expect(result).toEqual({
+      surfaceId: "surf-pending",
+      surfaceType: "list",
+      title: "Picks",
+      data: { items: [] },
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // The bug fix: rehydration on in-memory miss.
+  // -------------------------------------------------------------------------
+  test("rehydrates from DB when the conversation is not in memory", async () => {
+    // Simulate post-restart or post-eviction: nothing in memory, but the
+    // surface exists in the messages table and rehydration restores the
+    // conversation with its surfaceState repopulated from history.
+    memoryById = null;
+    rawGetReturn = { conversation_id: "conv-evicted" };
+    const restored = makeStub("conv-evicted");
+    restored.surfaceState.set("surf-restored", {
+      surfaceType: "card",
+      title: "Restored",
+      data: { from: "history" },
+    });
+    rehydrated = restored;
+
+    const handler = findHandler("surfaces_get_content");
+    const result = await handler({
+      pathParams: { surfaceId: "surf-restored" },
+      queryParams: { conversationId: "conv-evicted" },
+    });
+
+    expect(result).toEqual({
+      surfaceId: "surf-restored",
+      surfaceType: "card",
+      title: "Restored",
+      data: { from: "history" },
+    });
+    // Hit the in-memory map first, missed, fell through to the DB scan,
+    // then rehydrated. The DB scan keyed on the surfaceId.
+    expect(findConvCalls).toEqual(["conv-evicted"]);
+    expect(rawGetCalls).toHaveLength(1);
+    expect(rawGetCalls[0]!.params[0]).toBe(`%"surfaceId":"surf-restored"%`);
+    expect(getOrCreateCalls).toEqual(["conv-evicted"]);
+  });
+
+  test("400s when conversationId is missing", async () => {
+    const handler = findHandler("surfaces_get_content");
+
+    let caught: unknown;
+    try {
+      await handler({
+        pathParams: { surfaceId: "surf-1" },
+        queryParams: {},
+      });
+    } catch (err) {
+      caught = err;
+    }
+
+    expect(caught).toBeInstanceOf(BadRequestError);
+    expect(findConvCalls).toEqual([]);
+  });
+
+  test("404s when no row in the DB matches the surfaceId (truly unknown surface)", async () => {
+    // Cold-cache miss with no DB row — the surfaceId is bogus or has
+    // never been persisted. We must 404, not rehydrate a phantom
+    // conversation for the caller-supplied conversationId.
+    memoryById = null;
+    rawGetReturn = null;
+
+    const handler = findHandler("surfaces_get_content");
+
+    let caught: unknown;
+    try {
+      await handler({
+        pathParams: { surfaceId: "surf-missing" },
+        queryParams: { conversationId: "conv-unknown" },
+      });
+    } catch (err) {
+      caught = err;
+    }
+
+    expect(caught).toBeInstanceOf(NotFoundError);
+    // Rehydration must NOT have been called — otherwise an arbitrary
+    // caller could materialize empty conversations for any UUID.
+    expect(getOrCreateCalls).toEqual([]);
+  });
+
+  test("404s when the DB row's conversation_id mismatches the caller's", async () => {
+    // The surface lives on a different conversation than the caller
+    // claims. Refusing to rehydrate prevents cross-conversation
+    // information leakage via guessable surfaceIds.
+    memoryById = null;
+    rawGetReturn = { conversation_id: "conv-actual-owner" };
+
+    const handler = findHandler("surfaces_get_content");
+
+    let caught: unknown;
+    try {
+      await handler({
+        pathParams: { surfaceId: "surf-leaked" },
+        queryParams: { conversationId: "conv-attacker" },
+      });
+    } catch (err) {
+      caught = err;
+    }
+
+    expect(caught).toBeInstanceOf(NotFoundError);
+    expect(getOrCreateCalls).toEqual([]);
+  });
+
+  test("404s when rehydration succeeds but the surface still isn't present", async () => {
+    // Adversarial sanity check: the DB scan found a row pointing at a
+    // conversation, but after rehydration the surface neither lives in
+    // surfaceState nor in currentTurnSurfaces. (Shouldn't really
+    // happen given the scan keyed on the surfaceId — defensive.)
+    memoryById = null;
+    rawGetReturn = { conversation_id: "conv-evicted" };
+    rehydrated = makeStub("conv-evicted"); // empty surfaceState
+
+    const handler = findHandler("surfaces_get_content");
+
+    let caught: unknown;
+    try {
+      await handler({
+        pathParams: { surfaceId: "surf-gone" },
+        queryParams: { conversationId: "conv-evicted" },
+      });
+    } catch (err) {
+      caught = err;
+    }
+
+    expect(caught).toBeInstanceOf(NotFoundError);
+    expect(getOrCreateCalls).toEqual(["conv-evicted"]);
+  });
+});

package/src/runtime/routes/__tests__/task-routes.test.ts

@@ -195,9 +195,54 @@ mock.module("../../../tools/tasks/work-item-run.js", () => ({
 }));
 
 // Also mock getWorkspaceDir so handlers don't hit the real filesystem
-mock.module("../../../util/platform.js", () => ({
-  getWorkspaceDir: () => "/mock/workspace",
-}));
+mock.module("../../../util/platform.js", () => {
+  const stub = () => "/mock/workspace";
+  return {
+    getWorkspaceDir: () => "/mock/workspace",
+    vellumRoot: stub,
+    isMacOS: () => false,
+    isLinux: () => true,
+    isWindows: () => false,
+    getPlatformName: () => "linux",
+    normalizeAssistantId: (id: string) => id,
+    getDataDir: stub,
+    getEmbeddingModelsDir: stub,
+    getSandboxRootDir: stub,
+    getSandboxWorkingDir: stub,
+    getSoundsDir: stub,
+    getAvatarDir: stub,
+    AVATAR_IMAGE_FILENAME: "avatar-image.png",
+    getAvatarImagePath: stub,
+    getXdgVellumConfigDirName: () => ".vellum",
+    getPidPath: stub,
+    getDbPath: stub,
+    getLogsDir: stub,
+    getHistoryPath: stub,
+    getProtectedDir: stub,
+    getSignalsDir: stub,
+    getDaemonStderrLogPath: stub,
+    getDaemonStartupLockPath: stub,
+    getExternalDir: stub,
+    getBinDir: stub,
+    getDotEnvPath: stub,
+    getEmbedWorkerPidPath: stub,
+    getWorkspaceDirDisplay: stub,
+    getWorkspaceConfigPath: stub,
+    getWorkspaceSkillsDir: stub,
+    getWorkspaceHooksDir: stub,
+    getWorkspacePluginsDir: stub,
+    getWorkspaceRoutesDir: stub,
+    getDeprecatedDir: stub,
+    getConversationsDir: stub,
+    getWorkspacePromptPath: stub,
+    getProfilerRootDir: stub,
+    getProfilerRunsDir: stub,
+    getProfilerRunDir: stub,
+    getSkillRuntimePath: stub,
+    getBundledBunPath: () => undefined,
+    ensureDataDir: () => {},
+  };
+});
 
 // ---------------------------------------------------------------------------
 // Import route definitions after mocking

package/src/runtime/routes/acp-routes-list.test.ts

@@ -44,6 +44,9 @@ mock.module("../../memory/db-connection.js", () => {
   builder.all = () => [];
   return {
     getDb: () => builder,
+    getSqlite: () => ({ __stub: true }),
+    getSqliteFrom: () => ({ __stub: true }),
+    resetDb: () => {},
   };
 });
 

package/src/runtime/routes/app-management-routes.ts

@@ -786,7 +786,17 @@ export const ROUTES: RouteDefinition[] = [
       },
     ],
     responseBody: z.object({
-      apps: z.array(z.unknown()).describe("Array of app summary objects"),
+      apps: z.array(
+        z.object({
+          id: z.string(),
+          name: z.string(),
+          description: z.string().optional(),
+          icon: z.string().optional(),
+          createdAt: z.number(),
+          version: z.string(),
+          contentId: z.string(),
+        }),
+      ),
     }),
   },
   {
@@ -802,6 +812,21 @@ export const ROUTES: RouteDefinition[] = [
     requestBody: z.object({
       filePath: z.string().describe("Absolute path to the .vbundle file"),
     }),
+    responseBody: z.object({
+      manifest: z.object({}).passthrough(),
+      scanResult: z.object({
+        passed: z.boolean(),
+        blocked: z.array(z.string()),
+        warnings: z.array(z.string()),
+      }),
+      signatureResult: z.object({
+        trustTier: z.string(),
+        signerKeyId: z.string().optional(),
+        signerDisplayName: z.string().optional(),
+        signerAccount: z.string().optional(),
+      }),
+      bundleSizeBytes: z.number(),
+    }),
   },
   {
     operationId: "apps_shared_list",
@@ -813,7 +838,23 @@ export const ROUTES: RouteDefinition[] = [
     description: "Return all apps available via cloud share links.",
     tags: ["apps"],
     responseBody: z.object({
-      apps: z.array(z.unknown()).describe("Array of shared app objects"),
+      apps: z.array(
+        z.object({
+          uuid: z.string(),
+          name: z.string(),
+          description: z.string().optional(),
+          icon: z.string().optional(),
+          preview: z.string().optional(),
+          entry: z.string(),
+          trustTier: z.string(),
+          signerDisplayName: z.string().optional(),
+          bundleSizeBytes: z.number(),
+          installedAt: z.string(),
+          version: z.string().optional(),
+          contentId: z.string().optional(),
+          updateAvailable: z.boolean().optional(),
+        }),
+      ),
     }),
   },
   {
@@ -828,6 +869,11 @@ export const ROUTES: RouteDefinition[] = [
     requestBody: z.object({
       uuid: z.string().describe("UUID of the shared app to fork"),
     }),
+    responseBody: z.object({
+      success: z.literal(true),
+      appId: z.string(),
+      name: z.string(),
+    }),
   },
   {
     operationId: "apps_gallery_install",
@@ -839,6 +885,11 @@ export const ROUTES: RouteDefinition[] = [
     description: "Install an app from the built-in gallery by its ID.",
     tags: ["apps"],
     requestBody: z.object({ galleryAppId: z.string() }),
+    responseBody: z.object({
+      success: z.literal(true),
+      appId: z.string(),
+      name: z.string(),
+    }),
   },
   {
     operationId: "apps_gallery_list",
@@ -850,7 +901,28 @@ export const ROUTES: RouteDefinition[] = [
     description: "Return the built-in app gallery catalog.",
     tags: ["apps"],
     responseBody: z.object({
-      gallery: z.array(z.unknown()).describe("Gallery app entries"),
+      gallery: z.object({
+        version: z.number(),
+        updatedAt: z.string(),
+        categories: z.array(
+          z.object({
+            id: z.string(),
+            name: z.string(),
+            icon: z.string(),
+          }),
+        ),
+        apps: z.array(
+          z.object({
+            id: z.string(),
+            name: z.string(),
+            description: z.string(),
+            icon: z.string(),
+            category: z.string(),
+            version: z.string(),
+            featured: z.boolean().optional(),
+          }),
+        ),
+      }),
     }),
   },
   {
@@ -897,6 +969,12 @@ export const ROUTES: RouteDefinition[] = [
       keyId: z.string().optional(),
       publicKey: z.string().optional(),
     }),
+    responseBody: z.object({
+      signed: z.boolean().optional(),
+      signatureJson: z.object({}).passthrough().optional(),
+      payload: z.string().optional(),
+      message: z.string().optional(),
+    }),
   },
   {
     operationId: "apps_signing_identity",
@@ -908,6 +986,7 @@ export const ROUTES: RouteDefinition[] = [
     description:
       "Return signing identity info. Signing is managed client-side over HTTP.",
     tags: ["apps"],
+    responseBody: z.object({ message: z.string() }),
   },
 
   // Parameterized `apps/:id/*` routes — must follow all literal routes.
@@ -927,6 +1006,10 @@ export const ROUTES: RouteDefinition[] = [
         type: "string",
       },
     ],
+    responseBody: z.object({
+      success: z.boolean(),
+      result: z.unknown(),
+    }),
   },
   {
     operationId: "apps_data_mutate",
@@ -943,6 +1026,10 @@ export const ROUTES: RouteDefinition[] = [
       recordId: z.string(),
       data: z.object({}).passthrough(),
     }),
+    responseBody: z.object({
+      success: z.boolean(),
+      result: z.unknown(),
+    }),
   },
   {
     operationId: "apps_open",
@@ -969,6 +1056,7 @@ export const ROUTES: RouteDefinition[] = [
     summary: "Delete an app",
     description: "Permanently remove an app and its data.",
     tags: ["apps"],
+    responseBody: z.object({ success: z.boolean() }),
   },
   {
     operationId: "apps_preview_get",
@@ -979,6 +1067,10 @@ export const ROUTES: RouteDefinition[] = [
     summary: "Get app preview",
     description: "Return the preview image or HTML for an app.",
     tags: ["apps"],
+    responseBody: z.object({
+      appId: z.string(),
+      preview: z.string().nullable(),
+    }),
   },
   {
     operationId: "apps_preview_update",
@@ -992,6 +1084,10 @@ export const ROUTES: RouteDefinition[] = [
     requestBody: z.object({
       preview: z.string().describe("Base64-encoded image or HTML string"),
     }),
+    responseBody: z.object({
+      success: z.boolean(),
+      appId: z.string(),
+    }),
   },
   {
     operationId: "apps_history",
@@ -1005,7 +1101,13 @@ export const ROUTES: RouteDefinition[] = [
     queryParams: [{ name: "limit", type: "number" }],
     responseBody: z.object({
       appId: z.string(),
-      versions: z.array(z.unknown()),
+      versions: z.array(
+        z.object({
+          commitHash: z.string(),
+          message: z.string(),
+          timestamp: z.number(),
+        }),
+      ),
     }),
   },
   {
@@ -1021,6 +1123,10 @@ export const ROUTES: RouteDefinition[] = [
       { name: "fromCommit", type: "string", required: true },
       { name: "toCommit", type: "string" },
     ],
+    responseBody: z.object({
+      appId: z.string(),
+      diff: z.string(),
+    }),
   },
   {
     operationId: "apps_restore",
@@ -1032,6 +1138,7 @@ export const ROUTES: RouteDefinition[] = [
     description: "Restore an app to a previous git commit.",
     tags: ["apps"],
     requestBody: z.object({ commitHash: z.string() }),
+    responseBody: z.object({ success: z.boolean() }),
   },
   {
     operationId: "apps_bundle",