@vellumai/assistant 0.9.0 → 0.10.0-dev.202606192226.8ed8a6a

package/src/runtime/routes/__tests__/plugins-routes.test.ts

@@ -34,6 +34,12 @@
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import {
+  type DiffPluginDeps,
+  type DiffPluginOptions,
+  type PluginDiffResult,
+  PluginDiffUnavailableError,
+} from "../../../cli/lib/diff-plugin.js";
 import {
   type InspectPluginDeps,
   type InspectPluginOptions,
@@ -54,6 +60,11 @@ import {
   PluginDetailsNotFoundError,
   type PluginDetailsOptions,
 } from "../../../cli/lib/plugin-details.js";
+import {
+  DEFAULT_PIN_HISTORY_LIMIT,
+  type PluginPinHistoryEntry,
+  PluginPinHistoryError,
+} from "../../../cli/lib/plugin-pin-history.js";
 import type {
   PluginCatalog,
   PluginSearchMatch,
@@ -66,6 +77,7 @@ import {
   type UninstallPluginResult,
 } from "../../../cli/lib/uninstall-plugin.js";
 import {
+  PluginMergeBaselineError,
   PluginNotUpgradableError,
   type PluginUpgradeResult,
   type UpgradePluginDeps,
@@ -173,10 +185,49 @@ const upgradeSpy = mock(
 );
 
 mock.module("../../../cli/lib/upgrade-plugin.js", () => ({
+  PluginMergeBaselineError,
   PluginNotUpgradableError,
   upgradePlugin: upgradeSpy,
 }));
 
+// Mock diffPlugin: the lib re-materializes the install commit and computes the
+// per-file unified diff (covered by diff-plugin.test.ts); the route forwards
+// the name and maps the lib's error taxonomy to HTTP status codes.
+const diffSpy = mock(
+  async (
+    _opts: DiffPluginOptions,
+    _deps: DiffPluginDeps,
+  ): Promise<PluginDiffResult> => {
+    throw new Error("diffSpy default impl not configured");
+  },
+);
+
+mock.module("../../../cli/lib/diff-plugin.js", () => ({
+  PluginDiffUnavailableError,
+  diffPlugin: diffSpy,
+}));
+
+// Mock the pin-history lib: the GitHub commit-history walk is covered by
+// plugin-pin-history.test.ts; the routes only forward the name, validate a pin
+// against the resolved history, and map errors.
+const listPinHistorySpy = mock(
+  async (..._args: unknown[]): Promise<PluginPinHistoryEntry[]> => {
+    throw new Error("listPinHistorySpy default impl not configured");
+  },
+);
+const resolvePinSpy = mock(
+  async (..._args: unknown[]): Promise<PluginPinHistoryEntry | null> => {
+    throw new Error("resolvePinSpy default impl not configured");
+  },
+);
+
+mock.module("../../../cli/lib/plugin-pin-history.js", () => ({
+  DEFAULT_PIN_HISTORY_LIMIT,
+  PluginPinHistoryError,
+  listPinHistory: listPinHistorySpy,
+  resolvePinToMarketplaceCommit: resolvePinSpy,
+}));
+
 import {
   BadRequestError,
   ConflictError,
@@ -199,7 +250,9 @@ const uninstallHandler = findHandler("plugins_uninstall");
 const getHandler = findHandler("plugins_get");
 const installHandler = findHandler("plugins_install");
 const inspectHandler = findHandler("plugins_inspect");
+const versionsHandler = findHandler("plugins_versions");
 const upgradeHandler = findHandler("plugins_upgrade");
+const diffHandler = findHandler("plugins_diff");
 
 function invoke(args: RouteHandlerArgs = {}): {
   plugins: Array<Record<string, unknown>>;
@@ -802,6 +855,7 @@ async function invokeInstall(args: RouteHandlerArgs = {}): Promise<{
 describe("POST /v1/plugins/install", () => {
   beforeEach(() => {
     installSpy.mockReset();
+    resolvePinSpy.mockReset();
   });
 
   test("forwards name/force and shapes the result, pinning ref to the default", async () => {
@@ -928,6 +982,121 @@ describe("POST /v1/plugins/install", () => {
     expect(caught).toBeInstanceOf(InternalError);
     expect((caught as Error).message).toContain("ECONNRESET");
   });
+
+  test("a reviewed pin installs from the marketplace commit that introduced it", async () => {
+    // GIVEN a pin that resolves to a marketplace commit in the reviewed history
+    resolvePinSpy.mockImplementation(async () => ({
+      pin: "a".repeat(40),
+      marketplaceCommit: "f".repeat(40),
+      promotedAt: "2026-06-01T00:00:00.000Z",
+      current: false,
+    }));
+    installSpy.mockImplementation(async (opts) => ({
+      name: opts.name,
+      target: `/workspace/.vellum/plugins/${opts.name}`,
+      fileCount: 7,
+      ref: opts.ref ?? "main",
+      commit: "a".repeat(40),
+      committedAt: null,
+    }));
+
+    const result = await invokeInstall({
+      body: { name: "caveman", pin: "a".repeat(40) },
+    });
+
+    // THEN the install reads the manifest at the resolving marketplace commit,
+    // not the default branch
+    expect(installSpy.mock.calls[0]?.[0]).toEqual({
+      name: "caveman",
+      ref: "f".repeat(40),
+      force: undefined,
+    });
+    expect(result.ref).toBe("f".repeat(40));
+  });
+
+  test("an unreviewed pin is refused as a BadRequest before installing", async () => {
+    resolvePinSpy.mockImplementation(async () => null);
+
+    await expect(
+      invokeInstall({ body: { name: "caveman", pin: "b".repeat(40) } }),
+    ).rejects.toBeInstanceOf(BadRequestError);
+    expect(installSpy).not.toHaveBeenCalled();
+  });
+
+  test("a pin-history read failure surfaces as ServiceUnavailable (503)", async () => {
+    resolvePinSpy.mockImplementation(async () => {
+      throw new PluginPinHistoryError("HTTP 403");
+    });
+
+    await expect(
+      invokeInstall({ body: { name: "caveman", pin: "c".repeat(40) } }),
+    ).rejects.toBeInstanceOf(ServiceUnavailableError);
+    expect(installSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe("GET /v1/plugins/:name/versions", () => {
+  beforeEach(() => {
+    listPinHistorySpy.mockReset();
+  });
+
+  test("returns the resolved pin history", async () => {
+    const history: PluginPinHistoryEntry[] = [
+      {
+        pin: "c".repeat(40),
+        marketplaceCommit: "3".repeat(40),
+        promotedAt: "2026-06-10T00:00:00.000Z",
+        current: true,
+      },
+      {
+        pin: "a".repeat(40),
+        marketplaceCommit: "1".repeat(40),
+        promotedAt: "2026-06-01T00:00:00.000Z",
+        current: false,
+      },
+    ];
+    listPinHistorySpy.mockImplementation(async () => history);
+
+    const result = await versionsHandler({ pathParams: { name: "level-up" } });
+    expect(result).toEqual(history);
+  });
+
+  test("forwards a positive limit to the lib", async () => {
+    listPinHistorySpy.mockImplementation(async () => []);
+    await versionsHandler({
+      pathParams: { name: "level-up" },
+      queryParams: { limit: "3" },
+    });
+    expect(listPinHistorySpy.mock.calls[0]?.[2]).toEqual({ limit: 3 });
+  });
+
+  test("rejects a non-positive limit as BadRequest before calling the lib", async () => {
+    await expect(
+      versionsHandler({
+        pathParams: { name: "level-up" },
+        queryParams: { limit: "0" },
+      }),
+    ).rejects.toBeInstanceOf(BadRequestError);
+    expect(listPinHistorySpy).not.toHaveBeenCalled();
+  });
+
+  test("InvalidPluginNameError → BadRequestError (400)", async () => {
+    listPinHistorySpy.mockImplementation(async () => {
+      throw new InvalidPluginNameError("../escape");
+    });
+    await expect(
+      versionsHandler({ pathParams: { name: "../escape" } }),
+    ).rejects.toBeInstanceOf(BadRequestError);
+  });
+
+  test("PluginPinHistoryError → ServiceUnavailableError (503)", async () => {
+    listPinHistorySpy.mockImplementation(async () => {
+      throw new PluginPinHistoryError("HTTP 429");
+    });
+    await expect(
+      versionsHandler({ pathParams: { name: "level-up" } }),
+    ).rejects.toBeInstanceOf(ServiceUnavailableError);
+  });
 });
 
 function inspection(
@@ -976,6 +1145,10 @@ function inspection(
           }
         : overrides.remote,
     remoteError: overrides.remoteError ?? null,
+    surfaces:
+      overrides.surfaces === undefined
+        ? { skills: [], hooks: ["post-model-call"], tools: [] }
+        : overrides.surfaces,
   };
 }
 
@@ -1080,6 +1253,9 @@ function upgradeResult(
     target: overrides.target ?? "/workspace/.vellum/plugins/level-up",
     fileCount: overrides.fileCount === undefined ? 12 : overrides.fileCount,
     dryRun: overrides.dryRun ?? false,
+    strategy: overrides.strategy ?? "overwrite",
+    conflicts: overrides.conflicts ?? [],
+    binaryConflicts: overrides.binaryConflicts ?? [],
     provenanceWasUnknown: overrides.provenanceWasUnknown ?? false,
   };
 }
@@ -1094,6 +1270,9 @@ async function invokeUpgrade(args: RouteHandlerArgs = {}): Promise<{
   target: string;
   fileCount: number | null;
   dryRun: boolean;
+  strategy: string;
+  conflicts: readonly string[];
+  binaryConflicts: readonly string[];
   provenanceWasUnknown: boolean;
 }> {
   return (await upgradeHandler(args)) as {
@@ -1106,6 +1285,9 @@ async function invokeUpgrade(args: RouteHandlerArgs = {}): Promise<{
     target: string;
     fileCount: number | null;
     dryRun: boolean;
+    strategy: string;
+    conflicts: readonly string[];
+    binaryConflicts: readonly string[];
     provenanceWasUnknown: boolean;
   };
 }
@@ -1136,15 +1318,85 @@ describe("POST /v1/plugins/:name/upgrade", () => {
       target: "/workspace/.vellum/plugins/level-up",
       fileCount: 12,
       dryRun: false,
+      strategy: "overwrite",
+      conflicts: [],
+      binaryConflicts: [],
       provenanceWasUnknown: false,
     });
-    // AND the name + dryRun are forwarded to the lib
+    // AND the name + dryRun are forwarded to the lib (strategy omitted)
     expect(upgradeSpy.mock.calls[0]?.[0]).toEqual({
       name: "level-up",
       dryRun: false,
+      strategy: undefined,
+    });
+  });
+
+  test("forwards a requested strategy to the lib and projects it", async () => {
+    // GIVEN upgradePlugin merges local edits forward via the `ours` strategy
+    upgradeSpy.mockImplementation(async () =>
+      upgradeResult({ strategy: "ours" }),
+    );
+
+    // WHEN the handler runs with a strategy in the body
+    const result = await invokeUpgrade({
+      pathParams: { name: "level-up" },
+      body: { strategy: "ours" },
+    });
+
+    // THEN the strategy is forwarded to the lib and surfaced on the wire
+    expect(result.strategy).toBe("ours");
+    expect(upgradeSpy.mock.calls[0]?.[0]).toEqual({
+      name: "level-up",
+      dryRun: undefined,
+      strategy: "ours",
     });
   });
 
+  test("projects conflicts + binaryConflicts from the assistant strategy onto the wire", async () => {
+    // GIVEN upgradePlugin merges with conflict markers under `assistant`
+    upgradeSpy.mockImplementation(async () =>
+      upgradeResult({
+        strategy: "assistant",
+        conflicts: ["hooks/post-model-call.ts"],
+        binaryConflicts: ["assets/icon.png"],
+      }),
+    );
+
+    // WHEN the handler runs with the `assistant` strategy
+    const result = await invokeUpgrade({
+      pathParams: { name: "level-up" },
+      body: { strategy: "assistant" },
+    });
+
+    // THEN the conflicted paths are surfaced for the assistant to resolve
+    expect(result.strategy).toBe("assistant");
+    expect(result.conflicts).toEqual(["hooks/post-model-call.ts"]);
+    expect(result.binaryConflicts).toEqual(["assets/icon.png"]);
+    expect(upgradeSpy.mock.calls[0]?.[0]).toEqual({
+      name: "level-up",
+      dryRun: undefined,
+      strategy: "assistant",
+    });
+  });
+
+  test("PluginMergeBaselineError \u2192 ConflictError (409)", async () => {
+    // A merge strategy whose install-time baseline can't be reconstructed: a
+    // well-formed request that isn't actionable in the current state.
+    upgradeSpy.mockImplementation(async () => {
+      throw new PluginMergeBaselineError(
+        "level-up",
+        "the install-time baseline could not be faithfully reconstructed",
+      );
+    });
+
+    await expect(
+      invokeUpgrade({
+        pathParams: { name: "level-up" },
+        body: { strategy: "ours" },
+      }),
+    ).rejects.toBeInstanceOf(ConflictError);
+  });
+
   test("omits dryRun (passes undefined) when the body flag is absent", async () => {
     // GIVEN a no-op upgrade where the install already matches the pin
     upgradeSpy.mockImplementation(async () =>
@@ -1246,3 +1498,133 @@ describe("POST /v1/plugins/:name/upgrade", () => {
     expect((caught as Error).message).toContain("ECONNRESET");
   });
 });
+
+function diffResult(
+  overrides: Partial<PluginDiffResult> = {},
+): PluginDiffResult {
+  return {
+    name: overrides.name ?? "level-up",
+    target: overrides.target ?? "/workspace/.vellum/plugins/level-up",
+    commit: overrides.commit ?? "60a392b0000000000000000000000000000000aa",
+    committedAt: overrides.committedAt ?? "2026-06-01T12:34:56.000Z",
+    clean: overrides.clean ?? false,
+    files: overrides.files ?? [
+      {
+        path: "src/skill.ts",
+        status: "modified",
+        diff: "--- a/src/skill.ts\n+++ b/src/skill.ts\n@@ -1 +1 @@\n-old\n+new\n",
+        binary: false,
+        reconstructed: true,
+      },
+    ],
+  };
+}
+
+async function invokeDiff(
+  args: RouteHandlerArgs = {},
+): Promise<PluginDiffResult> {
+  return (await diffHandler(args)) as PluginDiffResult;
+}
+
+describe("POST /v1/plugins/:name/diff", () => {
+  beforeEach(() => {
+    diffSpy.mockReset();
+  });
+
+  test("forwards the name to diffPlugin and returns the diff verbatim", async () => {
+    // GIVEN diffPlugin reports a single modified file against the install commit
+    const view = diffResult();
+    diffSpy.mockImplementation(async () => view);
+
+    // WHEN the route handler is invoked with the path name
+    const result = await invokeDiff({ pathParams: { name: "level-up" } });
+
+    // THEN the diff is returned unchanged
+    expect(result).toEqual(view);
+    // AND only the name is forwarded to the lib (ref is never caller-supplied)
+    expect(diffSpy.mock.calls[0]?.[0]).toEqual({ name: "level-up" });
+  });
+
+  test("InvalidPluginNameError → BadRequestError (400)", async () => {
+    diffSpy.mockImplementation(async () => {
+      throw new InvalidPluginNameError("../escape");
+    });
+
+    await expect(
+      invokeDiff({ pathParams: { name: "../escape" } }),
+    ).rejects.toBeInstanceOf(BadRequestError);
+  });
+
+  test("PluginNotInstalledError → NotFoundError (404)", async () => {
+    diffSpy.mockImplementation(async () => {
+      throw new PluginNotInstalledError(
+        "ghost",
+        "/workspace/.vellum/plugins/ghost",
+      );
+    });
+
+    await expect(
+      invokeDiff({ pathParams: { name: "ghost" } }),
+    ).rejects.toBeInstanceOf(NotFoundError);
+  });
+
+  test("PluginNotFoundError → NotFoundError (404)", async () => {
+    // The recorded commit no longer resolves to a tree (source/commit gone).
+    diffSpy.mockImplementation(async () => {
+      throw new PluginNotFoundError(
+        "level-up",
+        "deadbeef",
+        "vellum-ai/level-up",
+      );
+    });
+
+    await expect(
+      invokeDiff({ pathParams: { name: "level-up" } }),
+    ).rejects.toBeInstanceOf(NotFoundError);
+  });
+
+  test("PluginDiffUnavailableError → ConflictError (409)", async () => {
+    // The install recorded no commit, so there is no baseline to diff against:
+    // a well-formed request that is not actionable in the current state.
+    diffSpy.mockImplementation(async () => {
+      throw new PluginDiffUnavailableError(
+        "level-up",
+        "no install commit was recorded",
+      );
+    });
+
+    await expect(
+      invokeDiff({ pathParams: { name: "level-up" } }),
+    ).rejects.toBeInstanceOf(ConflictError);
+  });
+
+  test("PluginSourceUnavailableError → ServiceUnavailableError (503)", async () => {
+    // Re-materializing the baseline can hit a rate-limited/down GitHub; that is
+    // retryable, so surface 503 rather than a misleading 500.
+    diffSpy.mockImplementation(async () => {
+      throw new PluginSourceUnavailableError(
+        "git clone failed for vellum-ai/level-up: HTTP 403",
+        503,
+      );
+    });
+
+    await expect(
+      invokeDiff({ pathParams: { name: "level-up" } }),
+    ).rejects.toBeInstanceOf(ServiceUnavailableError);
+  });
+
+  test("unknown errors → InternalError with original message preserved", async () => {
+    diffSpy.mockImplementation(async () => {
+      throw new Error("ECONNRESET");
+    });
+
+    let caught: unknown;
+    try {
+      await invokeDiff({ pathParams: { name: "level-up" } });
+    } catch (err) {
+      caught = err;
+    }
+    expect(caught).toBeInstanceOf(InternalError);
+    expect((caught as Error).message).toContain("ECONNRESET");
+  });
+});

package/src/runtime/routes/app-routes.ts

@@ -45,7 +45,7 @@ function loadDesignSystemCss(): string {
   try {
     const cssPath = join(
       import.meta.dirname ?? __dirname,
-      "../../../../clients/macos/vellum-assistant/Resources/vellum-design-system.css",
+      "assets/vellum-design-system.css",
     );
     designSystemCssCache = readFileSync(cssPath, "utf-8");
   } catch {

package/src/runtime/routes/approval-routes.ts

@@ -116,21 +116,35 @@ function handleConfirm({ body }: RouteHandlerArgs) {
  */
 function handleSecret({ body }: RouteHandlerArgs) {
   const requestId = body?.requestId as string | undefined;
-  const value = body?.value as string | undefined;
   const delivery = body?.delivery as string | undefined;
 
   if (!requestId || typeof requestId !== "string") {
     throw new BadRequestError("requestId is required");
   }
 
+  // Legacy compat shim: already-shipped web clients send `delivery: "none"` to
+  // cancel a secret prompt. Normalize it to the cancellation path (value
+  // undefined) so the request settles cleanly rather than 400-ing and stranding
+  // the pending interaction.
+  const isCancel = delivery === "none";
+  const value = isCancel
+    ? undefined
+    : (body?.value as string | undefined);
+
   if (
     delivery !== undefined &&
     delivery !== "store" &&
-    delivery !== "transient_send"
+    delivery !== "transient_send" &&
+    delivery !== "none"
   ) {
     throw new BadRequestError('delivery must be "store" or "transient_send"');
   }
 
+  const effectiveDelivery =
+    isCancel || delivery === undefined
+      ? undefined
+      : (delivery as "store" | "transient_send");
+
   const interaction = pendingInteractions.get(requestId);
   if (!interaction) {
     throw new NotFoundError("No pending interaction found for this requestId");
@@ -153,11 +167,7 @@ function handleSecret({ body }: RouteHandlerArgs) {
     ? findConversation(interaction.conversationId)
     : undefined;
   if (conversation?.hasPendingSecret(requestId)) {
-    conversation.handleSecretResponse(
-      requestId,
-      value,
-      delivery as "store" | "transient_send" | undefined,
-    );
+    conversation.handleSecretResponse(requestId, value, effectiveDelivery);
     return { accepted: true };
   }
 
@@ -170,7 +180,7 @@ function handleSecret({ body }: RouteHandlerArgs) {
   );
   (resolved?.rpcResolve as ((r: SecretPromptResult) => void) | undefined)?.({
     value: value ?? null,
-    delivery: (delivery as SecretDelivery) ?? "store",
+    delivery: (effectiveDelivery as SecretDelivery) ?? "store",
   });
   return { accepted: true };
 }
@@ -246,6 +256,15 @@ function handleListPendingInteractions({ queryParams }: RouteHandlerArgs) {
     pendingSecret: secret
       ? {
           requestId: secret.requestId,
+          service: secret.secretDetails?.service,
+          field: secret.secretDetails?.field,
+          label: secret.secretDetails?.label,
+          description: secret.secretDetails?.description,
+          placeholder: secret.secretDetails?.placeholder,
+          purpose: secret.secretDetails?.purpose,
+          allowedTools: secret.secretDetails?.allowedTools,
+          allowedDomains: secret.secretDetails?.allowedDomains,
+          allowOneTimeSend: secret.secretDetails?.allowOneTimeSend,
         }
       : null,
   };
@@ -340,8 +359,20 @@ export const ROUTES: RouteDefinition[] = [
         .describe("Pending confirmation details or null")
         .optional(),
       pendingSecret: z
-        .object({})
+        .object({
+          requestId: z.string(),
+          service: z.string().optional(),
+          field: z.string().optional(),
+          label: z.string().optional(),
+          description: z.string().optional(),
+          placeholder: z.string().optional(),
+          purpose: z.string().optional(),
+          allowedTools: z.array(z.string()).optional(),
+          allowedDomains: z.array(z.string()).optional(),
+          allowOneTimeSend: z.boolean().optional(),
+        })
         .passthrough()
+        .nullable()
         .describe("Pending secret request or null")
         .optional(),
       interactions: z

package/src/runtime/routes/approval-strategies/guardian-callback-strategy.ts

@@ -763,7 +763,7 @@ async function handleAccessRequestApproval(
   const requesterContactResult = approval.requesterExternalUserId
     ? findContactChannel({
         channelType: approval.channel,
-        externalUserId: approval.requesterExternalUserId,
+        address: approval.requesterExternalUserId,
       })
     : null;
   const requesterDisplayName =
@@ -772,7 +772,7 @@ async function handleAccessRequestApproval(
   const decidedByContactResult = decidedByExternalUserId
     ? findContactChannel({
         channelType: approval.channel,
-        externalUserId: decidedByExternalUserId,
+        address: decidedByExternalUserId,
       })
     : null;
   const decidedByDisplayName =