@vellumai/assistant 0.8.7 → 0.8.8-dev.202606052332.17fc8ea

package/src/runtime/routes/__tests__/conversation-list-routes.test.ts

@@ -23,7 +23,7 @@ mock.module("../../assistant-event-hub.js", () => ({
   broadcastMessage: () => {},
 }));
 
-import { findConversation } from "../../../daemon/conversation-store.js";
+import { findConversation } from "../../../daemon/conversation-registry.js";
 import { createConversation } from "../../../memory/conversation-crud.js";
 import { getDb } from "../../../memory/db-connection.js";
 import { initializeDb } from "../../../memory/db-init.js";

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -175,7 +175,10 @@ function seedRequestLog(
     .run();
 }
 
-function seedConversationKey(conversationKey: string, conversationId: string): void {
+function seedConversationKey(
+  conversationKey: string,
+  conversationId: string,
+): void {
   getDb()
     .insert(conversationKeys)
     .values({
@@ -776,6 +779,33 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
     });
   });
 
+  test("saves a profile using the minimax provider (regression #32404)", async () => {
+    // minimax is exposed as a first-class provider in the catalog, so saving
+    // a profile bound to it must pass ProfileEntry validation rather than 400.
+    const result = await replaceProfileRoute.handler({
+      pathParams: { name: "custom" },
+      body: {
+        provider: "minimax",
+        model: "MiniMax-M2.7",
+      },
+    });
+
+    expect(result).toEqual({ ok: true });
+    const savedProfile = (
+      savedRawConfig?.llm as {
+        profiles: Record<string, Record<string, unknown>>;
+      }
+    ).profiles.custom;
+
+    expect(savedProfile.provider).toBe("minimax");
+    expect(savedProfile.model).toBe("MiniMax-M2.7");
+    expect(savedProfile.provider_connection).toBe("minimax-personal");
+
+    const conn = getConnection(getDb(), "minimax-personal");
+    expect(conn).not.toBeNull();
+    expect(conn!.provider).toBe("minimax");
+  });
+
   describe("managed profile guard", () => {
     beforeEach(() => {
       // Seed a managed profile alongside the existing custom one.

package/src/runtime/routes/__tests__/memory-v2-routes.test.ts

@@ -155,7 +155,11 @@ describe("memory_v2_ema_scores route registration", () => {
     expect(route!.tags).toContain("memory");
     // Schema rejects unknown keys so accidental request-body fields fail
     // loudly during route adapter parsing rather than silently propagating.
-    expect(() => route!.requestBody!.parse({ extra: true })).toThrow();
-    expect(() => route!.requestBody!.parse({})).not.toThrow();
+    const requestBody = route!.requestBody;
+    if (!requestBody || !("parse" in requestBody)) {
+      throw new Error("expected a JSON (Zod) request-body schema");
+    }
+    expect(() => requestBody.parse({ extra: true })).toThrow();
+    expect(() => requestBody.parse({})).not.toThrow();
   });
 });

package/src/runtime/routes/__tests__/surface-action-routes.test.ts

@@ -42,7 +42,7 @@ const findBySurfaceCalls: string[] = [];
 const getOrCreateCalls: string[] = [];
 const rawGetCalls: Array<{ sql: string; params: unknown[] }> = [];
 
-mock.module("../../../daemon/conversation-store.js", () => ({
+mock.module("../../../daemon/conversation-registry.js", () => ({
   findConversation: (id: string) => {
     findConvCalls.push(id);
     return memoryById ?? undefined;
@@ -51,6 +51,9 @@ mock.module("../../../daemon/conversation-store.js", () => ({
     findBySurfaceCalls.push(surfaceId);
     return memoryBySurface ?? undefined;
   },
+}));
+
+mock.module("../../../daemon/conversation-store.js", () => ({
   getOrCreateConversation: async (id: string) => {
     getOrCreateCalls.push(id);
     if (!rehydrated) {
@@ -183,9 +186,7 @@ describe("triggerSurfaceAction handler", () => {
     // SQL must filter the messages table by ui_surface payload pattern.
     expect(rawGetCalls[0]!.sql).toContain("FROM messages");
     expect(rawGetCalls[0]!.sql).toContain("LIKE");
-    expect(rawGetCalls[0]!.params).toEqual([
-      `%"surfaceId":"surf-evicted"%`,
-    ]);
+    expect(rawGetCalls[0]!.params).toEqual([`%"surfaceId":"surf-evicted"%`]);
     expect(getOrCreateCalls).toEqual(["conv-from-db"]);
     expect(rehydrated.surfaceActionCalls).toEqual([
       { surfaceId: "surf-evicted", actionId: "act-3", data: undefined },

package/src/runtime/routes/__tests__/surface-content-routes.test.ts

@@ -51,7 +51,7 @@ const findBySurfaceCalls: string[] = [];
 const getOrCreateCalls: string[] = [];
 const rawGetCalls: Array<{ sql: string; params: unknown[] }> = [];
 
-mock.module("../../../daemon/conversation-store.js", () => ({
+mock.module("../../../daemon/conversation-registry.js", () => ({
   findConversation: (id: string) => {
     findConvCalls.push(id);
     return memoryById ?? undefined;
@@ -60,6 +60,9 @@ mock.module("../../../daemon/conversation-store.js", () => ({
     findBySurfaceCalls.push(surfaceId);
     return undefined;
   },
+}));
+
+mock.module("../../../daemon/conversation-store.js", () => ({
   getOrCreateConversation: async (id: string) => {
     getOrCreateCalls.push(id);
     if (!rehydrated) {

package/src/runtime/routes/__tests__/tts-routes.test.ts

@@ -164,8 +164,12 @@ afterEach(() => {
 // ---------------------------------------------------------------------------
 
 describe("tts-routes", () => {
-  test("exports route definitions for messages/:messageId/tts, tts/synthesize, and tts/synthesize-cli", () => {
-    expect(ROUTES).toHaveLength(3);
+  test("exports route definitions for tts/providers, messages/:messageId/tts, tts/synthesize, and tts/synthesize-cli", () => {
+    expect(ROUTES).toHaveLength(4);
+
+    const providers = getRoute("tts/providers");
+    expect(providers.method).toBe("GET");
+    expect(providers.policy?.requiredScopes).toContain("settings.read");
 
     const msgTts = getRoute("messages/:messageId/tts");
     expect(msgTts.method).toBe("POST");

package/src/runtime/routes/acp-routes.test.ts

@@ -2,25 +2,28 @@
  * Tests for the ACP route handlers.
  *
  * Suites:
- *  - POST /v1/acp/spawn — the three failure paths produced by
- *    `resolveAcpAgent` (acp_disabled, unknown_agent, binary_not_found).
+ *  - POST /v1/acp/spawn: resolver failure paths (acp_disabled,
+ *    unknown_agent) and the body-shape guard. The binary_not_found /
+ *    auto-install surface is covered in `__tests__/acp-routes.test.ts`.
  *  - POST /v1/acp/spawn (env injection) — CLAUDE_CODE_OAUTH_TOKEN is read
  *    from the credential broker (policy-gated + audited) and merged into
  *    `agentConfig.env` ONLY for the `claude` agent.
  *  - DELETE /v1/acp/sessions?status=completed — the bulk-clear route that
  *    wipes terminal-state rows (completed/failed/cancelled) from
- *    `acp_session_history` while leaving running/initializing rows intact.
+ *    `acp_session_history` while leaving running/initializing rows and
+ *    rows with an in-flight resume intact.
  *  - DELETE /v1/acp/sessions/:id — single-row delete: completed → 200,
- *    running → 409, unknown id → idempotent { deleted: false }.
+ *    running or mid-resume → 409, unknown id → idempotent
+ *    { deleted: false }.
  *
  * The spawn tests mirror the resolver's test setup using the shared
  * `installAcpConfigStub` and `installWhichStub` helpers so the host
  * environment doesn't influence the resolver's PATH preflight.
  *
- * The single-id delete tests stub `getAcpSessionManager` so we can drive
- * the in-memory-status check without spawning real ACP child processes,
- * and use the real DB (initialized via the test preload's per-file
- * workspace) to verify the row is actually removed.
+ * The delete tests stub `getAcpSessionManager` so we can drive the
+ * in-memory-status and pending-resume checks without spawning real ACP
+ * child processes, and use the real DB (initialized via the test preload's
+ * per-file workspace) to verify the row is actually removed.
  */
 
 import {
@@ -48,8 +51,10 @@ afterAll(() => {
 // in-memory-status check without spawning real ACP processes, and so the
 // env-injection spawn tests can capture the `agentConfig` arg without
 // launching a real subprocess. Stored in mutable state so individual tests
-// can plant arbitrary states / inspect capture.
+// can plant arbitrary states / inspect capture. `pendingResumeIds` models
+// ids reserved by an in-flight resumeFromHistory (no SessionEntry yet).
 const inMemoryStates = new Map<string, AcpSessionState>();
+const pendingResumeIds = new Set<string>();
 
 interface CapturedSpawn {
   agent: string;
@@ -70,6 +75,9 @@ mock.module("../../acp/index.js", () => ({
       if (!state) throw new Error(`ACP session "${id}" not found`);
       return state;
     },
+    getActiveAndPendingIds: () => [
+      ...new Set([...inMemoryStates.keys(), ...pendingResumeIds]),
+    ],
     spawn: async (
       agent: string,
       agentConfig: { env?: Record<string, string> },
@@ -226,22 +234,6 @@ describe("POST /v1/acp/spawn", () => {
     ).rejects.toThrow('Unknown agent "nonexistent"');
   });
 
-  test("throws FailedDependencyError when the agent binary is missing", async () => {
-    config.setConfig({ agents: {} });
-    which.setWhich({});
-
-    const handler = getSpawnHandler();
-    await expect(
-      handler({
-        body: {
-          agent: "codex",
-          task: "do a thing",
-          conversationId: "conv-1",
-        },
-      }),
-    ).rejects.toThrow("codex-acp is not on PATH");
-  });
-
   test("body-shape guard short-circuits before the resolver runs", async () => {
     config.setConfig({ enabled: false });
 
@@ -457,6 +449,8 @@ describe("DELETE /v1/acp/sessions?status=completed", () => {
   });
 
   beforeEach(() => {
+    inMemoryStates.clear();
+    pendingResumeIds.clear();
     getSqlite().run("DELETE FROM acp_session_history");
   });
 
@@ -482,6 +476,57 @@ describe("DELETE /v1/acp/sessions?status=completed", () => {
     ]);
   });
 
+  test("excludes terminal rows whose session is active in memory (resumed sessions)", async () => {
+    // A resumed session reuses its original id: the in-memory state is
+    // `running` while its history row still carries the old terminal
+    // status until the next terminal upsert. The bulk delete must not
+    // remove that row out from under the live session.
+    seedHistoryRow("row-resumed", "completed", 1000);
+    seedHistoryRow("row-completed", "completed", 2000);
+    inMemoryStates.set("row-resumed", {
+      id: "row-resumed",
+      agentId: "claude",
+      acpSessionId: "proto-resumed",
+      parentConversationId: "conv-test",
+      status: "running",
+      startedAt: 1000,
+    });
+
+    const handler = getBulkDeleteHandler();
+    const result = (await handler({
+      queryParams: { status: "completed" },
+    })) as {
+      deleted: number;
+    };
+    expect(result.deleted).toBe(1);
+
+    const remaining = listRows();
+    expect(remaining).toEqual([{ id: "row-resumed", status: "completed" }]);
+  });
+
+  test("excludes terminal rows whose session has a resume in flight", async () => {
+    // A resume that is still awaiting env preparation has no in-memory
+    // SessionEntry yet, but its history row (still terminal) must survive:
+    // deleting it mid-resume would let the later terminal upsert resurrect
+    // it as an orphan row.
+    seedHistoryRow("row-pending-resume", "completed", 1000);
+    seedHistoryRow("row-completed", "completed", 2000);
+    pendingResumeIds.add("row-pending-resume");
+
+    const handler = getBulkDeleteHandler();
+    const result = (await handler({
+      queryParams: { status: "completed" },
+    })) as {
+      deleted: number;
+    };
+    expect(result.deleted).toBe(1);
+
+    const remaining = listRows();
+    expect(remaining).toEqual([
+      { id: "row-pending-resume", status: "completed" },
+    ]);
+  });
+
   test("returns deleted=0 when no terminal rows are present", async () => {
     seedHistoryRow("row-running", "running", 1000);
 
@@ -559,6 +604,7 @@ describe("DELETE /v1/acp/sessions/:id", () => {
 
   beforeEach(() => {
     inMemoryStates.clear();
+    pendingResumeIds.clear();
     getDb().delete(acpSessionHistory).run();
   });
 
@@ -610,6 +656,24 @@ describe("DELETE /v1/acp/sessions/:id", () => {
     },
   );
 
+  test("returns 409 when the session has a resume in flight (not yet in memory)", async () => {
+    pendingResumeIds.add("sess-resuming");
+    insertHistoryRow({ id: "sess-resuming", status: "completed" });
+
+    const handler = getDeleteSessionHandler();
+    expect(() => handler({ pathParams: { id: "sess-resuming" } })).toThrow(
+      "resume in flight",
+    );
+
+    // Row untouched.
+    const remaining = getDb()
+      .select()
+      .from(acpSessionHistory)
+      .where(eq(acpSessionHistory.id, "sess-resuming"))
+      .all();
+    expect(remaining).toHaveLength(1);
+  });
+
   test("idempotent for unknown id — returns { deleted: false }", async () => {
     const handler = getDeleteSessionHandler();
     const result = (await handler({

package/src/runtime/routes/acp-routes.ts

@@ -4,12 +4,14 @@
  * Exposes spawn, steer, cancel, close, sessions, and permission operations
  * over HTTP and IPC.
  */
-import { desc, eq, inArray } from "drizzle-orm";
+import { and, desc, eq, inArray, notInArray } from "drizzle-orm";
 import { z } from "zod";
 
+import { resolveAgentWithAutoInstall } from "../../acp/auto-install.js";
 import { getAcpSessionManager } from "../../acp/index.js";
 import { prepareAgentEnv } from "../../acp/prepare-agent-env.js";
-import { resolveAcpAgent } from "../../acp/resolve-agent.js";
+import { formatResolveFailure } from "../../acp/resolve-agent.js";
+import { AcpResumeError } from "../../acp/session-manager.js";
 import type { AcpSessionState } from "../../acp/types.js";
 import { getDb } from "../../memory/db-connection.js";
 import { rawChanges } from "../../memory/raw-query.js";
@@ -61,26 +63,19 @@ async function spawnSession({ body }: RouteHandlerArgs) {
     throw new BadRequestError("agent, task, and conversationId are required");
   }
 
-  const resolved = resolveAcpAgent(agent);
+  // Resolve the agent, silently auto-installing a missing allowlisted
+  // adapter binary (see acp/auto-install.ts). Shared with the skill-tool
+  // path in tools/acp/spawn.ts; only the transport mapping differs.
+  const { resolved, failureMessage } = await resolveAgentWithAutoInstall(agent);
+  if (failureMessage) {
+    throw new FailedDependencyError(failureMessage);
+  }
   if (!resolved.ok) {
-    switch (resolved.reason) {
-      case "acp_disabled":
-        throw new BadRequestError(resolved.hint);
-      case "unknown_agent":
-        throw new BadRequestError(
-          `Unknown agent "${agent}". Available: ${resolved.available.join(", ")}.`,
-        );
-      case "binary_not_found":
-        throw new FailedDependencyError(
-          `${resolved.command} is not on PATH. ${resolved.hint}`,
-        );
-      default: {
-        const _exhaustive: never = resolved;
-        throw new Error(
-          `Unexpected acp resolver reason: ${(_exhaustive as { reason: string }).reason}`,
-        );
-      }
+    const message = formatResolveFailure(agent, resolved);
+    if (resolved.reason === "binary_not_found") {
+      throw new FailedDependencyError(message);
     }
+    throw new BadRequestError(message);
   }
 
   // Inject required env vars and preflight via the shared helper. See
@@ -116,13 +111,31 @@ async function steerSession({ pathParams, body }: RouteHandlerArgs) {
     throw new BadRequestError("instruction is required");
   }
 
+  // Sessions no longer in memory (completed, or lost to a daemon restart)
+  // are transparently resumed from persisted history with the instruction
+  // fired in the same call, mirroring the acp_steer skill tool.
+  // broadcastMessage plays the sender role spawnSession gives it, so
+  // connected clients render the session.
   const manager = getAcpSessionManager();
   try {
-    await manager.steer(id, instruction);
-  } catch {
+    const { resumed } = await manager.steerOrResume(
+      id,
+      instruction,
+      broadcastMessage,
+    );
+    return resumed
+      ? { acpSessionId: id, steered: true, resumed: true }
+      : { acpSessionId: id, steered: true };
+  } catch (err) {
+    // Resume errors carry the actionable hint (legacy row without cwd,
+    // agent capability missing, resolver failures, ...).
+    if (err instanceof AcpResumeError) {
+      throw new FailedDependencyError(err.message);
+    }
+    // Unknown ids (no in-memory session, no history row) and plain steer
+    // failures both map to 404, as before.
     throw new NotFoundError("ACP session not found");
   }
-  return { acpSessionId: id, steered: true };
 }
 
 async function cancelSession({ pathParams }: RouteHandlerArgs) {
@@ -161,9 +174,25 @@ function bulkDeleteSessions({ queryParams }: RouteHandlerArgs) {
       "status query param is required and must be 'completed'",
     );
   }
+  // Exclude sessions currently active in memory AND ids with a resume in
+  // flight (reserved but not yet registered): a resumed session reuses its
+  // original id, and its history row keeps the old terminal status until
+  // the next terminal upsert - a status-only delete would remove the row
+  // out from under the live (or resuming) session, and the later terminal
+  // upsert would resurrect it. Mirrors the 409 guard on the single-id
+  // delete route.
+  const activeIds = getAcpSessionManager().getActiveAndPendingIds();
+  const terminalFilter = inArray(
+    acpSessionHistory.status,
+    TERMINAL_SESSION_STATUSES,
+  );
   getDb()
     .delete(acpSessionHistory)
-    .where(inArray(acpSessionHistory.status, TERMINAL_SESSION_STATUSES))
+    .where(
+      activeIds.length > 0
+        ? and(terminalFilter, notInArray(acpSessionHistory.id, activeIds))
+        : terminalFilter,
+    )
     .run();
   const deleted = rawChanges();
   log.info({ deleted }, "Bulk-cleared terminal ACP session history");
@@ -172,9 +201,10 @@ function bulkDeleteSessions({ queryParams }: RouteHandlerArgs) {
 
 function deleteSession({ pathParams }: RouteHandlerArgs) {
   const id = pathParams?.id as string;
+  const manager = getAcpSessionManager();
 
   try {
-    const state = getAcpSessionManager().getStatus(id);
+    const state = manager.getStatus(id);
     if (
       !Array.isArray(state) &&
       (state.status === "running" || state.status === "initializing")
@@ -185,7 +215,16 @@ function deleteSession({ pathParams }: RouteHandlerArgs) {
     }
   } catch (err) {
     if (err instanceof ConflictError) throw err;
-    // Not in memory — fall through to the (idempotent) DB delete.
+    // Not registered in memory, but a resume may be in flight (id reserved
+    // while awaiting env preparation). Its history row must survive until
+    // the resume lands - the later terminal upsert would resurrect a
+    // deleted row.
+    if (manager.getActiveAndPendingIds().includes(id)) {
+      throw new ConflictError(
+        `ACP session "${id}" has a resume in flight. Wait for it to finish before deleting.`,
+      );
+    }
+    // Otherwise fall through to the (idempotent) DB delete.
   }
 
   getDb().delete(acpSessionHistory).where(eq(acpSessionHistory.id, id)).run();
@@ -233,7 +272,11 @@ export const ROUTES: RouteDefinition[] = [
     },
     handler: steerSession,
     summary: "Steer ACP session",
-    description: "Send a steering instruction to an active ACP session.",
+    description:
+      "Send a steering instruction to an ACP session. Sessions no longer " +
+      "in memory (completed, or lost to a daemon restart) are " +
+      "transparently resumed from persisted history first, when the agent " +
+      "supports ACP session loading.",
     tags: ["acp"],
     requestBody: z.object({
       instruction: z.string(),
@@ -241,6 +284,12 @@ export const ROUTES: RouteDefinition[] = [
     responseBody: z.object({
       acpSessionId: z.string(),
       steered: z.boolean(),
+      resumed: z
+        .boolean()
+        .optional()
+        .describe(
+          "True when the session was resumed from persisted history before steering.",
+        ),
     }),
   },
   {
@@ -324,7 +373,9 @@ export const ROUTES: RouteDefinition[] = [
     summary: "Bulk-clear terminal ACP sessions",
     description:
       "Remove every terminal-state row (completed/failed/cancelled) from " +
-      "the persisted acp_session_history table.",
+      "the persisted acp_session_history table. Rows whose session is " +
+      "currently active in memory (e.g. resumed) or has a resume in " +
+      "flight are excluded.",
     tags: ["acp"],
     queryParams: [
       {
@@ -350,7 +401,8 @@ export const ROUTES: RouteDefinition[] = [
     summary: "Delete ACP session from history",
     description:
       "Remove a persisted ACP session row. Rejects with 409 when the " +
-      "session is still active in memory; idempotent for unknown ids.",
+      "session is still active in memory or has a resume in flight; " +
+      "idempotent for unknown ids.",
     tags: ["acp"],
     responseBody: z.object({
       deleted: z.boolean(),

package/src/runtime/routes/app-management-routes.ts

@@ -1,6 +1,6 @@
 /**
  * Route handlers for app CRUD, bundling, sharing, versioning,
- * gallery, and signing operations.
+ * and signing operations.
  */
 import { randomBytes } from "node:crypto";
 import {
@@ -12,7 +12,7 @@ import {
 } from "node:fs";
 import { stat, unlink } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 
 import { z } from "zod";
 
@@ -22,7 +22,6 @@ import { scanBundle } from "../../bundler/bundle-scanner.js";
 import type { SignatureJson } from "../../bundler/bundle-signer.js";
 import { verifyBundleSignature } from "../../bundler/signature-verifier.js";
 import { compareSemver } from "../../daemon/handlers/shared.js";
-import { defaultGallery } from "../../gallery/default-gallery.js";
 import {
   getAppDiff,
   getAppHistory,
@@ -272,47 +271,6 @@ function forkSharedApp(
   return { success: true, appId: newApp.id, name: newApp.name };
 }
 
-async function installGalleryApp(
-  galleryAppId: string,
-): Promise<
-  | { success: true; appId: string; name: string }
-  | { success: false; error: string }
-> {
-  const galleryApp = defaultGallery.apps.find((a) => a.id === galleryAppId);
-  if (!galleryApp) {
-    return {
-      success: false,
-      error: `Gallery app not found: ${galleryAppId}`,
-    };
-  }
-
-  const app = createApp({
-    name: galleryApp.name,
-    description: galleryApp.description,
-    schemaJson: galleryApp.schemaJson,
-    htmlDefinition: galleryApp.htmlDefinition,
-    formatVersion: galleryApp.formatVersion,
-  });
-
-  if (galleryApp.formatVersion === 2 && galleryApp.sourceFiles) {
-    const appDir = getAppDirPath(app.id);
-    for (const [relPath, content] of Object.entries(galleryApp.sourceFiles)) {
-      const fullPath = join(appDir, relPath);
-      mkdirSync(dirname(fullPath), { recursive: true });
-      writeFileSync(fullPath, content, "utf-8");
-    }
-    const result = await compileApp(appDir);
-    if (!result.ok) {
-      log.warn(
-        { appId: app.id, errors: result.errors },
-        "Gallery app compilation had errors; falling back to htmlDefinition",
-      );
-    }
-  }
-
-  return { success: true, appId: app.id, name: app.name };
-}
-
 async function openBundle(filePath: string): Promise<Record<string, unknown>> {
   const fileStat = await stat(filePath);
   const bundleSizeBytes = fileStat.size;
@@ -594,22 +552,6 @@ function handleForkSharedApp({ body, headers }: RouteHandlerArgs) {
   return result;
 }
 
-async function handleInstallGalleryApp({ body, headers }: RouteHandlerArgs) {
-  if (!body?.galleryAppId) {
-    throw new BadRequestError("galleryAppId is required");
-  }
-  const result = await installGalleryApp(body.galleryAppId as string);
-  if (!result.success) {
-    throw new BadRequestError(result.error);
-  }
-  publishAppsChanged(getOriginClientId(headers));
-  return result;
-}
-
-function handleListGallery() {
-  return { gallery: defaultGallery };
-}
-
 function handleSignBundle({ body }: RouteHandlerArgs) {
   if (!body?.payload) {
     throw new BadRequestError("payload is required");
@@ -900,62 +842,6 @@ export const ROUTES: RouteDefinition[] = [
       name: z.string(),
     }),
   },
-  {
-    operationId: "apps_gallery_install",
-    endpoint: "apps/gallery/install",
-    method: "POST",
-    policy: {
-      requiredScopes: ["settings.write"],
-      allowedPrincipalTypes: ACTOR_PRINCIPALS,
-    },
-    handler: handleInstallGalleryApp,
-    summary: "Install a gallery app",
-    description: "Install an app from the built-in gallery by its ID.",
-    tags: ["apps"],
-    requestBody: z.object({ galleryAppId: z.string() }),
-    responseBody: z.object({
-      success: z.literal(true),
-      appId: z.string(),
-      name: z.string(),
-    }),
-  },
-  {
-    operationId: "apps_gallery_list",
-    endpoint: "apps/gallery",
-    method: "GET",
-    policy: {
-      requiredScopes: ["settings.read"],
-      allowedPrincipalTypes: ACTOR_PRINCIPALS,
-    },
-    handler: handleListGallery,
-    summary: "List gallery apps",
-    description: "Return the built-in app gallery catalog.",
-    tags: ["apps"],
-    responseBody: z.object({
-      gallery: z.object({
-        version: z.number(),
-        updatedAt: z.string(),
-        categories: z.array(
-          z.object({
-            id: z.string(),
-            name: z.string(),
-            icon: z.string(),
-          }),
-        ),
-        apps: z.array(
-          z.object({
-            id: z.string(),
-            name: z.string(),
-            description: z.string(),
-            icon: z.string(),
-            category: z.string(),
-            version: z.string(),
-            featured: z.boolean().optional(),
-          }),
-        ),
-      }),
-    }),
-  },
   {
     operationId: "apps_import_bundle",
     endpoint: "apps/import-bundle",
@@ -969,7 +855,10 @@ export const ROUTES: RouteDefinition[] = [
     description:
       "Upload, validate, and install a .vbundle archive as a new local app.",
     tags: ["apps"],
-    rawBody: true,
+    requestBody: {
+      contentType: "application/octet-stream",
+      schema: { type: "string", format: "binary" },
+    },
     responseBody: z.object({
       success: z.boolean(),
       appId: z.string(),