@vellumai/assistant 0.8.7 → 0.8.8

package/src/runtime/routes/__tests__/consolidation-routes.test.ts

@@ -24,7 +24,10 @@
  *     once assistant output exists.
  */
 
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../../../util/logger.js", () => ({
   getLogger: () =>
@@ -33,19 +36,28 @@ mock.module("../../../util/logger.js", () => ({
     }),
 }));
 
+import { invalidateConfigCache } from "../../../config/loader.js";
 import { createConversation } from "../../../memory/conversation-crud.js";
 import { getDb } from "../../../memory/db-connection.js";
 import { initializeDb } from "../../../memory/db-init.js";
-import { rawRun } from "../../../memory/raw-query.js";
+import { enqueueMemoryJob } from "../../../memory/jobs-store.js";
+import { recordUsageEvent } from "../../../memory/llm-usage-store.js";
+import { rawAll, rawRun } from "../../../memory/raw-query.js";
 import { ROUTES } from "../consolidation-routes.js";
 import type { RouteDefinition } from "../types.js";
 
 initializeDb();
 
+let workspaceDir: string;
+let origWorkspaceDir: string | undefined;
+let configPath: string;
+
 function resetTables(): void {
   const db = getDb();
+  db.run(`DELETE FROM llm_usage_events`);
   db.run(`DELETE FROM messages`);
   db.run(`DELETE FROM conversations`);
+  db.run(`DELETE FROM memory_jobs`);
 }
 
 function findHandler(operationId: string): RouteDefinition["handler"] {
@@ -69,6 +81,59 @@ function insertMessage(
   );
 }
 
+function recordUsageCostAt(
+  conversationId: string,
+  requestId: string,
+  createdAt: number,
+  estimatedCostUsd: number,
+): void {
+  const event = recordUsageEvent(
+    {
+      conversationId,
+      runId: null,
+      requestId,
+      actor: "main_agent",
+      callSite: "mainAgent",
+      inferenceProfile: "balanced",
+      provider: "anthropic",
+      model: "claude-sonnet-4-20250514",
+      inputTokens: 100,
+      outputTokens: 50,
+      cacheCreationInputTokens: 0,
+      cacheReadInputTokens: 0,
+      rawUsage: null,
+    },
+    { estimatedCostUsd, pricingStatus: "priced" },
+  );
+  rawRun(
+    "UPDATE llm_usage_events SET created_at = ? WHERE id = ?",
+    createdAt,
+    event.id,
+  );
+}
+
+function readConfig(): Record<string, unknown> {
+  return JSON.parse(readFileSync(configPath, "utf-8"));
+}
+
+function readMemoryJobRows(): Array<{
+  id: string;
+  status: string;
+  lastError: string | null;
+  payload: string;
+}> {
+  return rawAll<{
+    id: string;
+    status: string;
+    lastError: string | null;
+    payload: string;
+  }>(`
+    SELECT id, status, last_error AS lastError, payload
+    FROM memory_jobs
+    ORDER BY id
+  `);
+}
+
 interface RunRecord {
   id: string;
   scheduledFor: number;
@@ -79,6 +144,7 @@ interface RunRecord {
   skipReason: string | null;
   error: string | null;
   conversationId: string | null;
+  estimatedCostUsd: number;
   createdAt: number;
 }
 
@@ -88,9 +154,24 @@ interface ListRunsResponse {
 
 describe("listConsolidationRuns handler", () => {
   beforeEach(() => {
+    workspaceDir = mkdtempSync(join(tmpdir(), "vellum-consolidation-routes-"));
+    origWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR;
+    process.env.VELLUM_WORKSPACE_DIR = workspaceDir;
+    configPath = join(workspaceDir, "config.json");
+    invalidateConfigCache();
     resetTables();
   });
 
+  afterEach(() => {
+    if (origWorkspaceDir === undefined) {
+      delete process.env.VELLUM_WORKSPACE_DIR;
+    } else {
+      process.env.VELLUM_WORKSPACE_DIR = origWorkspaceDir;
+    }
+    invalidateConfigCache();
+    rmSync(workspaceDir, { recursive: true, force: true });
+  });
+
   test("returns only conversations sourced from memory_v2_consolidation", async () => {
     createConversation({ title: "c1", source: "memory_v2_consolidation" });
     createConversation({ title: "h1", source: "heartbeat" });
@@ -138,6 +219,47 @@ describe("listConsolidationRuns handler", () => {
     expect(run.createdAt).toBe(1000);
   });
 
+  test("exposes estimatedCostUsd from the conversation total when available", async () => {
+    const conv = createConversation({
+      title: "c1",
+      source: "memory_v2_consolidation",
+    });
+    rawRun(
+      "UPDATE conversations SET created_at = ?, total_estimated_cost = ? WHERE id = ?",
+      1000,
+      0.42,
+      conv.id,
+    );
+    insertMessage(conv.id, "assistant", 2000);
+    recordUsageCostAt(conv.id, "consolidation-fallback-cost", 1500, 0.99);
+
+    const handler = findHandler("listConsolidationRuns");
+    const result = (await handler({})) as ListRunsResponse;
+
+    expect(result.runs[0]!.estimatedCostUsd).toBeCloseTo(0.42);
+  });
+
+  test("falls back to conversation-window usage cost when the total is empty", async () => {
+    const conv = createConversation({
+      title: "c1",
+      source: "memory_v2_consolidation",
+    });
+    rawRun(
+      "UPDATE conversations SET created_at = ? WHERE id = ?",
+      1000,
+      conv.id,
+    );
+    insertMessage(conv.id, "assistant", 2000);
+    recordUsageCostAt(conv.id, "consolidation-before", 999, 0.4);
+    recordUsageCostAt(conv.id, "consolidation-inside", 1500, 0.07);
+    recordUsageCostAt(conv.id, "consolidation-after", 2001, 0.5);
+
+    const handler = findHandler("listConsolidationRuns");
+    const result = (await handler({})) as ListRunsResponse;
+
+    expect(result.runs[0]!.estimatedCostUsd).toBeCloseTo(0.07);
+  });
+
   test("synthesizes status='running' when conversation has no assistant message", async () => {
     createConversation({ title: "c1", source: "memory_v2_consolidation" });
 
@@ -256,3 +378,144 @@ describe("listConsolidationRuns handler", () => {
     expect(bad.runs).toHaveLength(5);
   });
 });
+
+describe("updateConsolidationConfig handler", () => {
+  beforeEach(() => {
+    workspaceDir = mkdtempSync(join(tmpdir(), "vellum-consolidation-routes-"));
+    origWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR;
+    process.env.VELLUM_WORKSPACE_DIR = workspaceDir;
+    configPath = join(workspaceDir, "config.json");
+    invalidateConfigCache();
+    resetTables();
+  });
+
+  afterEach(() => {
+    if (origWorkspaceDir === undefined) {
+      delete process.env.VELLUM_WORKSPACE_DIR;
+    } else {
+      process.env.VELLUM_WORKSPACE_DIR = origWorkspaceDir;
+    }
+    invalidateConfigCache();
+    rmSync(workspaceDir, { recursive: true, force: true });
+  });
+
+  test("persists only the consolidation enabled override without disabling memory v2", async () => {
+    writeFileSync(
+      configPath,
+      JSON.stringify(
+        {
+          memory: {
+            v2: {
+              enabled: true,
+              consolidation_interval_hours: 4,
+            },
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+
+    const handler = findHandler("updateConsolidationConfig");
+    const result = (await handler({ body: { enabled: false } })) as {
+      available: boolean;
+      enabled: boolean;
+      intervalMs: number;
+      nextRunAt: number | null;
+      success: boolean;
+    };
+
+    expect(readConfig()).toEqual({
+      memory: {
+        v2: {
+          enabled: true,
+          consolidation_interval_hours: 4,
+          consolidation_enabled: false,
+        },
+      },
+    });
+    expect(result).toMatchObject({
+      available: true,
+      enabled: false,
+      intervalMs: 4 * 60 * 60 * 1000,
+      nextRunAt: null,
+      success: true,
+    });
+  });
+
+  test("disabling automatic consolidation cancels pending automatic jobs but preserves manual run-now jobs", async () => {
+    writeFileSync(
+      configPath,
+      JSON.stringify(
+        {
+          memory: {
+            v2: {
+              enabled: true,
+              consolidation_enabled: true,
+            },
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+    const automaticJobId = enqueueMemoryJob("memory_v2_consolidate", {
+      trigger: "automatic",
+    });
+    const legacyJobId = enqueueMemoryJob("memory_v2_consolidate", {});
+    const manualJobId = enqueueMemoryJob("memory_v2_consolidate", {
+      trigger: "manual",
+    });
+
+    const handler = findHandler("updateConsolidationConfig");
+    await handler({ body: { enabled: false } });
+
+    const rowsById = new Map(
+      readMemoryJobRows().map((row) => [row.id, row] as const),
+    );
+    expect(rowsById.get(automaticJobId)).toMatchObject({
+      status: "failed",
+      lastError: "automatic_consolidation_disabled",
+    });
+    expect(rowsById.get(legacyJobId)).toMatchObject({
+      status: "failed",
+      lastError: "automatic_consolidation_disabled",
+    });
+    expect(rowsById.get(manualJobId)).toMatchObject({
+      status: "pending",
+      lastError: null,
+      payload: JSON.stringify({ trigger: "manual" }),
+    });
+  });
+
+  test("run-now remains available when automatic consolidation is disabled", async () => {
+    writeFileSync(
+      configPath,
+      JSON.stringify(
+        {
+          memory: {
+            v2: {
+              enabled: true,
+              consolidation_enabled: false,
+            },
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+
+    const handler = findHandler("runConsolidationNow");
+    const result = (await handler({})) as {
+      success: boolean;
+      ran: boolean;
+      jobId: string | null;
+    };
+
+    expect(result.success).toBe(true);
+    expect(result.ran).toBe(true);
+    expect(result.jobId).toBeString();
+    const row = readMemoryJobRows().find((job) => job.id === result.jobId);
+    expect(row?.payload).toBe(JSON.stringify({ trigger: "manual" }));
+  });
+});

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -175,7 +175,10 @@ function seedRequestLog(
     .run();
 }
 
-function seedConversationKey(conversationKey: string, conversationId: string): void {
+function seedConversationKey(
+  conversationKey: string,
+  conversationId: string,
+): void {
   getDb()
     .insert(conversationKeys)
     .values({
@@ -776,6 +779,33 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
     });
   });
 
+  test("saves a profile using the minimax provider (regression #32404)", async () => {
+    // minimax is exposed as a first-class provider in the catalog, so saving
+    // a profile bound to it must pass ProfileEntry validation rather than 400.
+    const result = await replaceProfileRoute.handler({
+      pathParams: { name: "custom" },
+      body: {
+        provider: "minimax",
+        model: "MiniMax-M2.7",
+      },
+    });
+
+    expect(result).toEqual({ ok: true });
+    const savedProfile = (
+      savedRawConfig?.llm as {
+        profiles: Record<string, Record<string, unknown>>;
+      }
+    ).profiles.custom;
+
+    expect(savedProfile.provider).toBe("minimax");
+    expect(savedProfile.model).toBe("MiniMax-M2.7");
+    expect(savedProfile.provider_connection).toBe("minimax-personal");
+
+    const conn = getConnection(getDb(), "minimax-personal");
+    expect(conn).not.toBeNull();
+    expect(conn!.provider).toBe("minimax");
+  });
+
   describe("managed profile guard", () => {
     beforeEach(() => {
       // Seed a managed profile alongside the existing custom one.

package/src/runtime/routes/__tests__/memory-v2-routes.test.ts

@@ -155,7 +155,11 @@ describe("memory_v2_ema_scores route registration", () => {
     expect(route!.tags).toContain("memory");
     // Schema rejects unknown keys so accidental request-body fields fail
     // loudly during route adapter parsing rather than silently propagating.
-    expect(() => route!.requestBody!.parse({ extra: true })).toThrow();
-    expect(() => route!.requestBody!.parse({})).not.toThrow();
+    const requestBody = route!.requestBody;
+    if (!requestBody || !("parse" in requestBody)) {
+      throw new Error("expected a JSON (Zod) request-body schema");
+    }
+    expect(() => requestBody.parse({ extra: true })).toThrow();
+    expect(() => requestBody.parse({})).not.toThrow();
   });
 });

package/src/runtime/routes/__tests__/tts-routes.test.ts

@@ -164,8 +164,12 @@ afterEach(() => {
 // ---------------------------------------------------------------------------
 
 describe("tts-routes", () => {
-  test("exports route definitions for messages/:messageId/tts, tts/synthesize, and tts/synthesize-cli", () => {
-    expect(ROUTES).toHaveLength(3);
+  test("exports route definitions for tts/providers, messages/:messageId/tts, tts/synthesize, and tts/synthesize-cli", () => {
+    expect(ROUTES).toHaveLength(4);
+
+    const providers = getRoute("tts/providers");
+    expect(providers.method).toBe("GET");
+    expect(providers.policy?.requiredScopes).toContain("settings.read");
 
     const msgTts = getRoute("messages/:messageId/tts");
     expect(msgTts.method).toBe("POST");

package/src/runtime/routes/app-management-routes.ts

@@ -1,6 +1,6 @@
 /**
  * Route handlers for app CRUD, bundling, sharing, versioning,
- * gallery, and signing operations.
+ * and signing operations.
  */
 import { randomBytes } from "node:crypto";
 import {
@@ -12,7 +12,7 @@ import {
 } from "node:fs";
 import { stat, unlink } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 
 import { z } from "zod";
 
@@ -22,7 +22,6 @@ import { scanBundle } from "../../bundler/bundle-scanner.js";
 import type { SignatureJson } from "../../bundler/bundle-signer.js";
 import { verifyBundleSignature } from "../../bundler/signature-verifier.js";
 import { compareSemver } from "../../daemon/handlers/shared.js";
-import { defaultGallery } from "../../gallery/default-gallery.js";
 import {
   getAppDiff,
   getAppHistory,
@@ -272,47 +271,6 @@ function forkSharedApp(
   return { success: true, appId: newApp.id, name: newApp.name };
 }
 
-async function installGalleryApp(
-  galleryAppId: string,
-): Promise<
-  | { success: true; appId: string; name: string }
-  | { success: false; error: string }
-> {
-  const galleryApp = defaultGallery.apps.find((a) => a.id === galleryAppId);
-  if (!galleryApp) {
-    return {
-      success: false,
-      error: `Gallery app not found: ${galleryAppId}`,
-    };
-  }
-
-  const app = createApp({
-    name: galleryApp.name,
-    description: galleryApp.description,
-    schemaJson: galleryApp.schemaJson,
-    htmlDefinition: galleryApp.htmlDefinition,
-    formatVersion: galleryApp.formatVersion,
-  });
-
-  if (galleryApp.formatVersion === 2 && galleryApp.sourceFiles) {
-    const appDir = getAppDirPath(app.id);
-    for (const [relPath, content] of Object.entries(galleryApp.sourceFiles)) {
-      const fullPath = join(appDir, relPath);
-      mkdirSync(dirname(fullPath), { recursive: true });
-      writeFileSync(fullPath, content, "utf-8");
-    }
-    const result = await compileApp(appDir);
-    if (!result.ok) {
-      log.warn(
-        { appId: app.id, errors: result.errors },
-        "Gallery app compilation had errors; falling back to htmlDefinition",
-      );
-    }
-  }
-
-  return { success: true, appId: app.id, name: app.name };
-}
-
 async function openBundle(filePath: string): Promise<Record<string, unknown>> {
   const fileStat = await stat(filePath);
   const bundleSizeBytes = fileStat.size;
@@ -594,22 +552,6 @@ function handleForkSharedApp({ body, headers }: RouteHandlerArgs) {
   return result;
 }
 
-async function handleInstallGalleryApp({ body, headers }: RouteHandlerArgs) {
-  if (!body?.galleryAppId) {
-    throw new BadRequestError("galleryAppId is required");
-  }
-  const result = await installGalleryApp(body.galleryAppId as string);
-  if (!result.success) {
-    throw new BadRequestError(result.error);
-  }
-  publishAppsChanged(getOriginClientId(headers));
-  return result;
-}
-
-function handleListGallery() {
-  return { gallery: defaultGallery };
-}
-
 function handleSignBundle({ body }: RouteHandlerArgs) {
   if (!body?.payload) {
     throw new BadRequestError("payload is required");
@@ -900,62 +842,6 @@ export const ROUTES: RouteDefinition[] = [
       name: z.string(),
     }),
   },
-  {
-    operationId: "apps_gallery_install",
-    endpoint: "apps/gallery/install",
-    method: "POST",
-    policy: {
-      requiredScopes: ["settings.write"],
-      allowedPrincipalTypes: ACTOR_PRINCIPALS,
-    },
-    handler: handleInstallGalleryApp,
-    summary: "Install a gallery app",
-    description: "Install an app from the built-in gallery by its ID.",
-    tags: ["apps"],
-    requestBody: z.object({ galleryAppId: z.string() }),
-    responseBody: z.object({
-      success: z.literal(true),
-      appId: z.string(),
-      name: z.string(),
-    }),
-  },
-  {
-    operationId: "apps_gallery_list",
-    endpoint: "apps/gallery",
-    method: "GET",
-    policy: {
-      requiredScopes: ["settings.read"],
-      allowedPrincipalTypes: ACTOR_PRINCIPALS,
-    },
-    handler: handleListGallery,
-    summary: "List gallery apps",
-    description: "Return the built-in app gallery catalog.",
-    tags: ["apps"],
-    responseBody: z.object({
-      gallery: z.object({
-        version: z.number(),
-        updatedAt: z.string(),
-        categories: z.array(
-          z.object({
-            id: z.string(),
-            name: z.string(),
-            icon: z.string(),
-          }),
-        ),
-        apps: z.array(
-          z.object({
-            id: z.string(),
-            name: z.string(),
-            description: z.string(),
-            icon: z.string(),
-            category: z.string(),
-            version: z.string(),
-            featured: z.boolean().optional(),
-          }),
-        ),
-      }),
-    }),
-  },
   {
     operationId: "apps_import_bundle",
     endpoint: "apps/import-bundle",
@@ -969,7 +855,10 @@ export const ROUTES: RouteDefinition[] = [
     description:
       "Upload, validate, and install a .vbundle archive as a new local app.",
     tags: ["apps"],
-    rawBody: true,
+    requestBody: {
+      contentType: "application/octet-stream",
+      schema: { type: "string", format: "binary" },
+    },
     responseBody: z.object({
       success: z.boolean(),
       appId: z.string(),

package/src/runtime/routes/app-routes.ts

@@ -73,14 +73,15 @@ function buildCsp(scriptSrc: string): string {
   ].join("; ");
 }
 
-function servePageHeaders({ pathParams }: ResponseHeaderArgs): Record<string, string> {
+function servePageHeaders({
+  pathParams,
+}: ResponseHeaderArgs): Record<string, string> {
   const appId = pathParams?.appId as string;
   const app = getApp(appId);
   // Multifile apps use external scripts — no 'unsafe-inline' for script-src.
   // Legacy apps contain inline event handlers that require 'unsafe-inline'.
-  const scriptSrc = app && isMultifileApp(app)
-    ? "'self'"
-    : "'self' 'unsafe-inline'";
+  const scriptSrc =
+    app && isMultifileApp(app) ? "'self'" : "'self' 'unsafe-inline'";
   return {
     "Content-Type": "text/html; charset=utf-8",
     "Content-Security-Policy": buildCsp(scriptSrc),
@@ -186,9 +187,7 @@ const DIST_CONTENT_TYPES: Record<string, string> = {
  * Serve a static file from an app's dist/ directory.
  * Validates the filename to prevent path traversal.
  */
-function handleServeDistFile({
-  pathParams,
-}: RouteHandlerArgs): Uint8Array {
+function handleServeDistFile({ pathParams }: RouteHandlerArgs): Uint8Array {
   const appId = pathParams?.appId as string;
   const filename = pathParams?.filename as string;
 
@@ -225,9 +224,7 @@ function handleServeDistFile({
 /** 50 MB — generous cap for zip app bundles. */
 const MAX_SHARE_BODY_BYTES = 50 * 1024 * 1024;
 
-async function handleShareApp({
-  rawBody,
-}: RouteHandlerArgs): Promise<{
+async function handleShareApp({ rawBody }: RouteHandlerArgs): Promise<{
   shareToken: string;
   shareUrl: string;
   bundleSizeBytes: number;
@@ -275,9 +272,7 @@ async function handleShareApp({
   };
 }
 
-function handleDownloadSharedApp({
-  pathParams,
-}: RouteHandlerArgs): Uint8Array {
+function handleDownloadSharedApp({ pathParams }: RouteHandlerArgs): Uint8Array {
   const shareToken = pathParams?.token as string;
   const record = getSharedAppLink(shareToken);
   if (!record) {
@@ -348,8 +343,7 @@ export const ROUTES: RouteDefinition[] = [
       allowedPrincipalTypes: ACTOR_PRINCIPALS,
     },
     summary: "Serve app dist file",
-    description:
-      "Serve a static asset from an app's compiled dist/ directory.",
+    description: "Serve a static asset from an app's compiled dist/ directory.",
     tags: ["apps"],
     responseHeaders: ({ pathParams }) => ({
       "Content-Type":
@@ -411,6 +405,10 @@ export const ROUTES: RouteDefinition[] = [
       "Content-Type": "application/zip",
       "Content-Disposition": 'attachment; filename="app.vellum"',
     },
+    responseBody: {
+      contentType: "application/zip",
+      schema: { type: "string", format: "binary" },
+    },
     handler: handleDownloadSharedApp,
   },
   {

package/src/runtime/routes/attachment-routes.ts

@@ -663,6 +663,10 @@ export const ROUTES: RouteDefinition[] = [
       "Serve raw file bytes for an attachment. Supports Range headers.",
     tags: ["attachments"],
     responseStatus: ({ headers }) => (headers?.["range"] ? "206" : "200"),
+    responseBody: {
+      contentType: "application/octet-stream",
+      schema: { type: "string", format: "binary" },
+    },
     additionalResponses: {
       "416": { description: "Range Not Satisfiable" },
     },
@@ -719,21 +723,28 @@ export const ROUTES: RouteDefinition[] = [
     description:
       "Upload an attachment. Supports application/json (base64 data or file path reference), multipart/form-data (file + filename + mimeType fields), and application/octet-stream (raw bytes with filename and mimeType query params).",
     tags: ["attachments"],
-    requestBody: z.object({
-      filename: z.string(),
-      mimeType: z.string(),
-      data: z.string().describe("Base64-encoded file data").optional(),
-      filePath: z
-        .string()
-        .describe("On-disk file path (file-backed upload)")
-        .optional(),
-      trustedSource: z
-        .boolean()
-        .describe(
-          "Set by the gateway when the file came from a guardian-bound channel actor. Honored only when the request is authenticated as a gateway service token; ignored otherwise.",
-        )
-        .optional(),
-    }),
+    // Advertised as multipart/form-data — the form web clients actually send,
+    // so the generated SDK types a real `{ file, filename, mimeType }` body
+    // instead of erasing it. The handler additionally accepts application/json
+    // (base64/file-path) and application/octet-stream by sniffing the request
+    // Content-Type header (see handleUploadAttachmentRoute); those forms are
+    // used over raw HTTP by the gateway and are not consumed via the SDK.
+    requestBody: {
+      contentType: "multipart/form-data",
+      schema: {
+        type: "object",
+        properties: {
+          file: {
+            type: "string",
+            format: "binary",
+            description: "The file to upload",
+          },
+          filename: { type: "string" },
+          mimeType: { type: "string" },
+        },
+        required: ["file", "filename", "mimeType"],
+      },
+    },
     responseBody: z.object({
       id: z.string(),
       original_filename: z.string(),