@vellumai/assistant 0.8.5 → 0.8.7

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -477,6 +477,104 @@ describe("GET /v1/messages/:id/llm-context — agentLoopExitReason", () => {
   });
 });
 
+describe("GET /v1/messages/:id/llm-context — synthetic call_site projection", () => {
+  beforeEach(() => {
+    clearTables();
+  });
+
+  test("projects callSite='syntheticAgentErrorMessage' and the stamped exit reason for a synthetic row", async () => {
+    const messageId = "msg-yield";
+    seedConversationAndMessage({
+      conversationId: "conv-1",
+      messageId,
+      source: "user",
+      conversationType: "standard",
+    });
+    // Mirror what `recordSyntheticAgentErrorMessageLog` writes: synthetic
+    // envelope in BOTH payload columns (request = prepared LLM body the
+    // loop was about to send; response = the notice text the user saw),
+    // `call_site = "syntheticAgentErrorMessage"`, exit reason stamped at
+    // insert time.
+    getDb()
+      .insert(llmRequestLogs)
+      .values({
+        id: "log-yield",
+        conversationId: "conv-1",
+        messageId,
+        provider: null,
+        requestPayload: JSON.stringify({
+          syntheticAgentErrorMessage: {
+            exitReason: "budget_yield_unrecovered",
+            preparedRequest: { messages: [], maxInputTokensBudget: 200000 },
+          },
+        }),
+        responsePayload: JSON.stringify({
+          syntheticAgentErrorMessage: {
+            exitReason: "budget_yield_unrecovered",
+            noticeText:
+              "I tried to compact this but couldn't fit the next step.",
+          },
+        }),
+        createdAt: 1_700_000_000_000,
+        agentLoopExitReason: "budget_yield_unrecovered",
+        callSite: "syntheticAgentErrorMessage",
+      })
+      .run();
+
+    const body = (await dispatchLlmContext(messageId)) as {
+      logs: Array<{
+        id: string;
+        callSite: string | null;
+        agentLoopExitReason: string | null;
+      }>;
+    };
+
+    expect(body.logs).toHaveLength(1);
+    const row = body.logs[0]!;
+    expect(row.callSite).toBe("syntheticAgentErrorMessage");
+    expect(row.agentLoopExitReason).toBe("budget_yield_unrecovered");
+    // Frontend branches on `callSite` alone — no separate syntheticEvent
+    // field needs to be projected.
+    expect(row).not.toHaveProperty("syntheticEvent");
+  });
+
+  test("projects callSite='mainAgent' for regular LLM-call rows", async () => {
+    const messageId = "msg-regular";
+    seedConversationAndMessage({
+      conversationId: "conv-1",
+      messageId,
+      source: "user",
+      conversationType: "standard",
+    });
+    getDb()
+      .insert(llmRequestLogs)
+      .values({
+        id: "log-regular",
+        conversationId: "conv-1",
+        messageId,
+        provider: "openai",
+        requestPayload: JSON.stringify({ model: "gpt-4.1", messages: [] }),
+        responsePayload: JSON.stringify({
+          choices: [{ message: { content: "hi" } }],
+        }),
+        createdAt: 1_700_000_000_000,
+        callSite: "mainAgent",
+      })
+      .run();
+
+    const body = (await dispatchLlmContext(messageId)) as {
+      logs: Array<{
+        id: string;
+        callSite: string | null;
+      }>;
+    };
+
+    expect(body.logs[0]!.callSite).toBe("mainAgent");
+    // No leftover syntheticEvent projection field on regular rows either.
+    expect(body.logs[0]!).not.toHaveProperty("syntheticEvent");
+  });
+});
+
 describe("PUT /v1/config/llm/profiles/:name", () => {
   beforeEach(() => {
     savedRawConfig = null;

package/src/runtime/routes/__tests__/heartbeat-routes.test.ts

@@ -90,7 +90,7 @@ describe("setHeartbeatConfig handler", () => {
     // invalidation + getConfig() read picked up the new on-disk state.
     expect(result.success).toBe(true);
     expect(result.enabled).toBe(true);
-    expect(result.intervalMs).toBe(30 * 60_000);
+    expect(result.intervalMs).toBe(60 * 60_000);
     expect(result.activeHoursStart).toBe(8);
     expect(result.activeHoursEnd).toBe(22);
   });

package/src/runtime/routes/__tests__/home-feed-routes.test.ts

@@ -22,6 +22,7 @@ mock.module("../../../runtime/assistant-event-hub.js", () => ({
     publish: publishSpy,
     subscribe: () => () => {},
   },
+  broadcastMessage: async () => {},
 }));
 
 // Stub conversation CRUD so we don't spin up a real sqlite DB.
@@ -61,6 +62,7 @@ mock.module("../../../memory/conversation-crud.js", () => ({
   getMessages: () => [],
   getMessagesPaginated: () => ({ messages: [], hasMore: false }),
   getMessageById: () => null,
+  reserveMessage: mock(async () => ({ id: "msg-reserve" })),
 }));
 
 // Dynamic imports so module mocks are wired before evaluation.
@@ -68,6 +70,7 @@ const {
   computeGreeting,
   formatRelativeTime,
   handleGetHomeFeed: _handleGetHomeFeed,
+  handleListHomeFeed,
   handlePatchFeedItem: _handlePatchFeedItem,
   handlePostFeedAction: _handlePostFeedAction,
   ROUTES,
@@ -152,9 +155,14 @@ type FeedItemFixture = {
   title: string;
   summary: string;
   timestamp: string;
-  status: "new" | "seen" | "acted_on";
+  status: "new" | "seen" | "acted_on" | "dismissed";
   expiresAt?: string;
   actions?: Array<{ id: string; label: string; prompt: string }>;
+  urgency?: "low" | "medium" | "high" | "critical";
+  category?: "security" | "scheduling" | "background" | "email" | "system";
+  conversationId?: string;
+  fromAssistant?: boolean;
+  noteworthy?: boolean;
   createdAt: string;
 };
 
@@ -563,3 +571,203 @@ describe("handlePostFeedAction", () => {
     expect(res.status).toBe(500);
   });
 });
+
+// ─── handleListHomeFeed ────────────────────────────────────────────────────
+
+describe("handleListHomeFeed", () => {
+  type ListResult = {
+    items: Array<{ id: string; status: string }>;
+    total: number;
+    returned: number;
+    hasMore: boolean;
+  };
+
+  test("excludes dismissed items by default", () => {
+    writeFeedFile([
+      makeItem({ id: "a", status: "new" }),
+      makeItem({ id: "b", status: "seen" }),
+      makeItem({ id: "c", status: "acted_on" }),
+      makeItem({ id: "d", status: "dismissed" }),
+    ]);
+
+    const result = handleListHomeFeed({ body: {} }) as ListResult;
+    expect(result.items.map((i) => i.id).sort()).toEqual(["a", "b", "c"]);
+    expect(result.total).toBe(3);
+    expect(result.hasMore).toBe(false);
+  });
+
+  test("includeDismissed: true returns dismissed items too", () => {
+    writeFeedFile([
+      makeItem({ id: "a", status: "new" }),
+      makeItem({ id: "d", status: "dismissed" }),
+    ]);
+
+    const result = handleListHomeFeed({
+      body: { includeDismissed: true },
+    }) as ListResult;
+    expect(result.items.map((i) => i.id).sort()).toEqual(["a", "d"]);
+  });
+
+  test("statuses filter overrides the dismissed-default exclusion", () => {
+    writeFeedFile([
+      makeItem({ id: "a", status: "new" }),
+      makeItem({ id: "b", status: "seen" }),
+      makeItem({ id: "d", status: "dismissed" }),
+    ]);
+
+    const result = handleListHomeFeed({
+      body: { statuses: ["dismissed"] },
+    }) as ListResult;
+    expect(result.items.map((i) => i.id)).toEqual(["d"]);
+  });
+
+  test("urgencies filter narrows by urgency and excludes items missing urgency", () => {
+    writeFeedFile([
+      makeItem({ id: "a", urgency: "high" }),
+      makeItem({ id: "b", urgency: "low" }),
+      makeItem({ id: "c" }),
+    ]);
+
+    const result = handleListHomeFeed({
+      body: { urgencies: ["high"] },
+    }) as ListResult;
+    expect(result.items.map((i) => i.id)).toEqual(["a"]);
+  });
+
+  test("categories filter narrows by category", () => {
+    writeFeedFile([
+      makeItem({ id: "a", category: "email" }),
+      makeItem({ id: "b", category: "background" }),
+    ]);
+
+    const result = handleListHomeFeed({
+      body: { categories: ["email"] },
+    }) as ListResult;
+    expect(result.items.map((i) => i.id)).toEqual(["a"]);
+  });
+
+  test("conversationId filter narrows by conversation", () => {
+    writeFeedFile([
+      makeItem({ id: "a", conversationId: "conv-1" }),
+      makeItem({ id: "b", conversationId: "conv-2" }),
+      makeItem({ id: "c" }),
+    ]);
+
+    const result = handleListHomeFeed({
+      body: { conversationId: "conv-1" },
+    }) as ListResult;
+    expect(result.items.map((i) => i.id)).toEqual(["a"]);
+  });
+
+  test("fromAssistant: true returns only assistant-emitted items", () => {
+    writeFeedFile([
+      makeItem({ id: "a", fromAssistant: true }),
+      makeItem({ id: "b", fromAssistant: false }),
+      makeItem({ id: "c" }),
+    ]);
+
+    const result = handleListHomeFeed({
+      body: { fromAssistant: true },
+    }) as ListResult;
+    expect(result.items.map((i) => i.id)).toEqual(["a"]);
+  });
+
+  test("noteworthy: true returns only noteworthy items", () => {
+    writeFeedFile([
+      makeItem({ id: "a", noteworthy: true }),
+      makeItem({ id: "b" }),
+    ]);
+
+    const result = handleListHomeFeed({
+      body: { noteworthy: true },
+    }) as ListResult;
+    expect(result.items.map((i) => i.id)).toEqual(["a"]);
+  });
+
+  test("before filter is strict (createdAt < before)", () => {
+    writeFeedFile([
+      makeItem({ id: "old", createdAt: "2026-05-01T00:00:00.000Z" }),
+      makeItem({ id: "edge", createdAt: "2026-05-15T00:00:00.000Z" }),
+      makeItem({ id: "new", createdAt: "2026-05-20T00:00:00.000Z" }),
+    ]);
+
+    const result = handleListHomeFeed({
+      body: { before: "2026-05-15T00:00:00.000Z" },
+    }) as ListResult;
+    expect(result.items.map((i) => i.id)).toEqual(["old"]);
+  });
+
+  test("after filter is strict (createdAt > after)", () => {
+    writeFeedFile([
+      makeItem({ id: "old", createdAt: "2026-05-01T00:00:00.000Z" }),
+      makeItem({ id: "edge", createdAt: "2026-05-15T00:00:00.000Z" }),
+      makeItem({ id: "new", createdAt: "2026-05-20T00:00:00.000Z" }),
+    ]);
+
+    const result = handleListHomeFeed({
+      body: { after: "2026-05-15T00:00:00.000Z" },
+    }) as ListResult;
+    expect(result.items.map((i) => i.id)).toEqual(["new"]);
+  });
+
+  test("limit and offset paginate; hasMore reflects remaining items", () => {
+    writeFeedFile(
+      Array.from({ length: 25 }, (_, i) =>
+        makeItem({
+          id: `i${String(i).padStart(2, "0")}`,
+          // distinct priorities so the file's sort is stable + deterministic
+          priority: 100 - i,
+        }),
+      ),
+    );
+
+    const page1 = handleListHomeFeed({
+      body: { limit: 10, offset: 0 },
+    }) as ListResult;
+    expect(page1.items).toHaveLength(10);
+    expect(page1.total).toBe(25);
+    expect(page1.returned).toBe(10);
+    expect(page1.hasMore).toBe(true);
+
+    const page3 = handleListHomeFeed({
+      body: { limit: 10, offset: 20 },
+    }) as ListResult;
+    expect(page3.items).toHaveLength(5);
+    expect(page3.hasMore).toBe(false);
+  });
+
+  test("invalid before timestamp throws 400", () => {
+    writeFeedFile([]);
+    let caught: unknown;
+    try {
+      handleListHomeFeed({ body: { before: "not-a-date" } });
+    } catch (err) {
+      caught = err;
+    }
+    expect(caught).toBeInstanceOf(RouteError);
+    expect((caught as { statusCode: number }).statusCode).toBe(400);
+  });
+
+  test("invalid filter shape throws 400", () => {
+    writeFeedFile([]);
+    let caught: unknown;
+    try {
+      handleListHomeFeed({ body: { urgencies: ["extreme"] } });
+    } catch (err) {
+      caught = err;
+    }
+    expect(caught).toBeInstanceOf(RouteError);
+    expect((caught as { statusCode: number }).statusCode).toBe(400);
+  });
+
+  test("expired items are excluded (matches readHomeFeed TTL behavior)", () => {
+    const past = new Date(Date.now() - 60_000).toISOString();
+    writeFeedFile([
+      makeItem({ id: "alive" }),
+      makeItem({ id: "dead", expiresAt: past }),
+    ]);
+
+    const result = handleListHomeFeed({ body: {} }) as ListResult;
+    expect(result.items.map((i) => i.id)).toEqual(["alive"]);
+  });
+});

package/src/runtime/routes/__tests__/inference-provider-connection-routes.test.ts

@@ -29,11 +29,12 @@ mock.module("../../../util/logger.js", () => ({
 
 // ── Real imports (after mocks) ────────────────────────────────────────────────
 
-import { _setOverridesForTesting } from "../../../config/assistant-feature-flags.js";
+import { setOverridesForTesting } from "../../../__tests__/feature-flag-test-helpers.js";
 import { getDb } from "../../../memory/db-connection.js";
 import { initializeDb } from "../../../memory/db-init.js";
 import { providerConnections } from "../../../memory/schema/inference.js";
-import { getPolicy } from "../../auth/route-policy.js";
+// Route policies are read directly off `route.policy` now (ATL-315
+// followup) — no registry lookup.
 import { BadRequestError, ConflictError, NotFoundError } from "../errors.js";
 import { ROUTES } from "../inference-provider-connection-routes.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
@@ -90,7 +91,7 @@ function seedConnection(opts: {
 beforeEach(() => {
   clearConnections();
   fakeConfig = {};
-  _setOverridesForTesting({ "openai-compatible-endpoints": true });
+  setOverridesForTesting({ "openai-compatible-endpoints": true });
 });
 
 // ── GET list ─────────────────────────────────────────────────────────────────
@@ -160,7 +161,7 @@ describe("GET inference/provider-connections (list)", () => {
   });
 
   test("hides openai-compatible rows when the feature flag is disabled", async () => {
-    _setOverridesForTesting({ "openai-compatible-endpoints": false });
+    setOverridesForTesting({ "openai-compatible-endpoints": false });
     seedConnection({
       name: "my-openai",
       provider: "openai",
@@ -181,7 +182,7 @@ describe("GET inference/provider-connections (list)", () => {
   });
 
   test("rejects openai-compatible provider filter when the feature flag is disabled", async () => {
-    _setOverridesForTesting({ "openai-compatible-endpoints": false });
+    setOverridesForTesting({ "openai-compatible-endpoints": false });
 
     await expect(
       call(findHandler("inference_provider_connections_list"), {
@@ -219,7 +220,7 @@ describe("GET inference/provider-connections/:name (single)", () => {
   });
 
   test("throws 404 for openai-compatible row when the feature flag is disabled", async () => {
-    _setOverridesForTesting({ "openai-compatible-endpoints": false });
+    setOverridesForTesting({ "openai-compatible-endpoints": false });
     seedConnection({
       name: "my-compatible",
       provider: "openai-compatible",
@@ -317,7 +318,7 @@ describe("POST inference/provider-connections (create)", () => {
   });
 
   test("rejects openai-compatible creation when the feature flag is disabled", async () => {
-    _setOverridesForTesting({ "openai-compatible-endpoints": false });
+    setOverridesForTesting({ "openai-compatible-endpoints": false });
 
     await expect(
       call(findHandler("inference_provider_connections_create"), {
@@ -530,10 +531,10 @@ describe("DELETE inference/provider-connections/:name (delete)", () => {
   });
 });
 
-// ── status + label fields ─────────────────────────────────────────────────────
+// ── label fields ─────────────────────────────────────────────────────────────
 
-describe("POST with label and status", () => {
-  test("creates connection with label and status, both echoed in response", async () => {
+describe("POST with label", () => {
+  test("creates connection with label, echoed in response", async () => {
     const result = (await call(
       findHandler("inference_provider_connections_create"),
       {
@@ -542,13 +543,11 @@ describe("POST with label and status", () => {
           provider: "anthropic",
           auth: { type: "platform" },
           label: "My Anthropic",
-          status: "active",
         },
       },
-    )) as { name: string; label: string | null; status: string };
+    )) as { name: string; label: string | null };
     expect(result.name).toBe("labeled-conn");
     expect(result.label).toBe("My Anthropic");
-    expect(result.status).toBe("active");
   });
 
   test("creates connection without label — label is null in response", async () => {
@@ -561,30 +560,12 @@ describe("POST with label and status", () => {
           auth: { type: "platform" },
         },
       },
-    )) as { label: string | null; status: string };
+    )) as { label: string | null };
     expect(result.label).toBeNull();
-    expect(result.status).toBe("active");
   });
 });
 
-describe("PATCH with status and label", () => {
-  test("updates status to disabled", async () => {
-    seedConnection({
-      name: "toggleable",
-      provider: "anthropic",
-      auth: { type: "platform" },
-    });
-
-    const result = (await call(
-      findHandler("inference_provider_connections_update"),
-      {
-        pathParams: { name: "toggleable" },
-        body: { auth: { type: "platform" }, status: "disabled" },
-      },
-    )) as { status: string };
-    expect(result.status).toBe("disabled");
-  });
-
+describe("PATCH with label", () => {
   test("updates label to a string", async () => {
     seedConnection({
       name: "set-label",
@@ -758,24 +739,7 @@ describe("Managed connection write protection", () => {
     });
   });
 
-  describe("PATCH status + label (allowed)", () => {
-    test("allows disabling a managed connection", async () => {
-      seedConnection({
-        name: "anthropic-managed",
-        provider: "anthropic",
-        auth: { type: "platform" },
-      });
-
-      const result = (await call(
-        findHandler("inference_provider_connections_update"),
-        {
-          pathParams: { name: "anthropic-managed" },
-          body: { auth: { type: "platform" }, status: "disabled" },
-        },
-      )) as { status: string };
-      expect(result.status).toBe("disabled");
-    });
-
+  describe("PATCH label (allowed)", () => {
     test("allows relabeling a managed connection", async () => {
       seedConnection({
         name: "openai-managed",
@@ -924,44 +888,34 @@ describe("isManaged flag on connection responses", () => {
 
 // ── Auth / route-policy wiring ────────────────────────────────────────────────
 
-describe("Route policy registrations", () => {
+describe("Route policy declarations", () => {
   test("GET list has settings.read policy", () => {
     const route = findRoute("inference_provider_connections_list");
-    const policyKey = `${route.policyKey ?? "inference/provider-connections"}:GET`;
-    const policy = getPolicy(policyKey);
-    expect(policy).toBeDefined();
-    expect(policy?.requiredScopes).toContain("settings.read");
+    expect(route.policy).not.toBeNull();
+    expect(route.policy!.requiredScopes).toContain("settings.read");
   });
 
   test("POST create has settings.write policy", () => {
     const route = findRoute("inference_provider_connections_create");
-    const policyKey = `${route.policyKey ?? "inference/provider-connections"}:POST`;
-    const policy = getPolicy(policyKey);
-    expect(policy).toBeDefined();
-    expect(policy?.requiredScopes).toContain("settings.write");
+    expect(route.policy).not.toBeNull();
+    expect(route.policy!.requiredScopes).toContain("settings.write");
   });
 
   test("GET single has settings.read policy", () => {
     const route = findRoute("inference_provider_connections_get");
-    const policyKey = `${route.policyKey ?? "inference/provider-connections/detail"}:GET`;
-    const policy = getPolicy(policyKey);
-    expect(policy).toBeDefined();
-    expect(policy?.requiredScopes).toContain("settings.read");
+    expect(route.policy).not.toBeNull();
+    expect(route.policy!.requiredScopes).toContain("settings.read");
   });
 
   test("PATCH update has settings.write policy", () => {
     const route = findRoute("inference_provider_connections_update");
-    const policyKey = `${route.policyKey ?? "inference/provider-connections/detail"}:PATCH`;
-    const policy = getPolicy(policyKey);
-    expect(policy).toBeDefined();
-    expect(policy?.requiredScopes).toContain("settings.write");
+    expect(route.policy).not.toBeNull();
+    expect(route.policy!.requiredScopes).toContain("settings.write");
   });
 
   test("DELETE has settings.write policy", () => {
     const route = findRoute("inference_provider_connections_delete");
-    const policyKey = `${route.policyKey ?? "inference/provider-connections/detail"}:DELETE`;
-    const policy = getPolicy(policyKey);
-    expect(policy).toBeDefined();
-    expect(policy?.requiredScopes).toContain("settings.write");
+    expect(route.policy).not.toBeNull();
+    expect(route.policy!.requiredScopes).toContain("settings.write");
   });
 });

package/src/runtime/routes/__tests__/memory-v2-simulate-route.test.ts

@@ -78,6 +78,9 @@ mock.module("../../../memory/v2/injection-events.js", () => ({
 // sentinel object is sufficient.
 mock.module("../../../memory/db-connection.js", () => ({
   getDb: () => ({ __stub: true }),
+  getSqlite: () => ({ __stub: true }),
+  getSqliteFrom: () => ({ __stub: true }),
+  resetDb: () => {},
 }));
 
 // Config loader. The simulate route reads `memory.v2.enabled` (must be
@@ -124,9 +127,54 @@ mock.module("../../../providers/provider-send-message.js", () => ({
 // Platform helpers. `getWorkspaceDir` must return the per-test tmp dir so
 // the route's page index points at the test workspace.
 let workspaceDir = "";
-mock.module("../../../util/platform.js", () => ({
-  getWorkspaceDir: () => workspaceDir,
-}));
+mock.module("../../../util/platform.js", () => {
+  const stub = () => workspaceDir;
+  return {
+    getWorkspaceDir: () => workspaceDir,
+    vellumRoot: stub,
+    isMacOS: () => false,
+    isLinux: () => true,
+    isWindows: () => false,
+    getPlatformName: () => "linux",
+    normalizeAssistantId: (id: string) => id,
+    getDataDir: stub,
+    getEmbeddingModelsDir: stub,
+    getSandboxRootDir: stub,
+    getSandboxWorkingDir: stub,
+    getSoundsDir: stub,
+    getAvatarDir: stub,
+    AVATAR_IMAGE_FILENAME: "avatar-image.png",
+    getAvatarImagePath: stub,
+    getXdgVellumConfigDirName: () => ".vellum",
+    getPidPath: stub,
+    getDbPath: stub,
+    getLogsDir: stub,
+    getHistoryPath: stub,
+    getProtectedDir: stub,
+    getSignalsDir: stub,
+    getDaemonStderrLogPath: stub,
+    getDaemonStartupLockPath: stub,
+    getExternalDir: stub,
+    getBinDir: stub,
+    getDotEnvPath: stub,
+    getEmbedWorkerPidPath: stub,
+    getWorkspaceDirDisplay: stub,
+    getWorkspaceConfigPath: stub,
+    getWorkspaceSkillsDir: stub,
+    getWorkspaceHooksDir: stub,
+    getWorkspacePluginsDir: stub,
+    getWorkspaceRoutesDir: stub,
+    getDeprecatedDir: stub,
+    getConversationsDir: stub,
+    getWorkspacePromptPath: stub,
+    getProfilerRootDir: stub,
+    getProfilerRunsDir: stub,
+    getProfilerRunDir: stub,
+    getSkillRuntimePath: stub,
+    getBundledBunPath: () => undefined,
+    ensureDataDir: () => {},
+  };
+});
 
 // ---------------------------------------------------------------------------
 // Import under test (after all mocks above)
@@ -144,8 +192,13 @@ const { invalidatePageIndex } =
 function makeProvider(pageIds: number[]): Provider {
   return {
     name: "stub",
-    sendMessage: async (messages, tools, systemPrompt, options) => {
-      providerCalls.push({ messages, tools, systemPrompt, options });
+    sendMessage: async (messages, options) => {
+      providerCalls.push({
+        messages,
+        tools: options?.tools,
+        systemPrompt: options?.systemPrompt,
+        options,
+      });
       return {
         model: "stub-model",
         stopReason: "tool_use",

package/src/runtime/routes/__tests__/sanity-routes.test.ts

@@ -264,17 +264,17 @@ describe("sanity_connect", () => {
 });
 
 // ---------------------------------------------------------------------------
-// Policy key verification
+// Route policy verification
 // ---------------------------------------------------------------------------
 
-describe("route policy keys", () => {
-  test("sanity_discover uses policyKey: secrets", () => {
+describe("route policies", () => {
+  test("sanity_discover requires settings.write (secrets-grade)", () => {
     const route = ROUTES.find((r) => r.operationId === "sanity_discover");
-    expect(route?.policyKey).toBe("secrets");
+    expect(route?.policy?.requiredScopes).toContain("settings.write");
   });
 
-  test("sanity_connect uses policyKey: secrets", () => {
+  test("sanity_connect requires settings.write (secrets-grade)", () => {
     const route = ROUTES.find((r) => r.operationId === "sanity_connect");
-    expect(route?.policyKey).toBe("secrets");
+    expect(route?.policy?.requiredScopes).toContain("settings.write");
   });
 });