@vellumai/assistant 0.9.0 → 0.10.0-staging.2

package/src/runtime/routes/schedule-routes.ts

@@ -7,8 +7,6 @@
 
 import { z } from "zod";
 
-import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
-import { getConfig } from "../../config/loader.js";
 import { getOrCreateConversation } from "../../daemon/conversation-store.js";
 import { INTERNAL_GUARDIAN_TRUST_CONTEXT } from "../../daemon/trust-context.js";
 import { bootstrapConversation } from "../../memory/conversation-bootstrap.js";
@@ -299,7 +297,6 @@ function handleCreateSchedule(body: Record<string, unknown>) {
   }
 
   if (mode === "workflow") {
-    assertWorkflowsEnabled();
     const workflowName =
       typeof body.workflowName === "string" ? body.workflowName.trim() : "";
     if (!workflowName) {
@@ -351,17 +348,6 @@ function handleCreateSchedule(body: Record<string, unknown>) {
   return handleListSchedules({});
 }
 
-/**
- * Reject workflow-mode schedule operations when the `workflows` feature flag
- * is off. Scheduled workflow runs would fail at trigger time (the run manager
- * hard-fails with WorkflowsDisabledError), so we fail fast at the route.
- */
-function assertWorkflowsEnabled(): void {
-  if (!isAssistantFeatureFlagEnabled("workflows", getConfig())) {
-    throw new BadRequestError("Workflows are not enabled.");
-  }
-}
-
 function handleToggleSchedule(id: string, body: Record<string, unknown>) {
   const enabled = body.enabled;
   if (typeof enabled !== "boolean") {
@@ -427,11 +413,6 @@ function handleUpdateSchedule(id: string, body: Record<string, unknown>) {
     );
   }
 
-  // Switching a schedule into workflow mode requires the workflows flag.
-  if (body.mode === "workflow") {
-    assertWorkflowsEnabled();
-  }
-
   // Mirror the create-side validation: a schedule whose RESULTING mode is
   // `workflow` must carry a non-empty `workflowName`. Without this, a PATCH can
   // leave a workflow-mode schedule nameless — the scheduler then hits the
@@ -946,9 +927,6 @@ async function handleRunScheduleNow(id: string) {
   // `schedule.message` (usually empty — workflow-mode create no longer requires
   // a message), running a no-op normal turn instead of the workflow.
   if (schedule.mode === "workflow") {
-    // Fail fast at the route when the flag is off (the run manager would also
-    // hard-fail with WorkflowsDisabledError); matches create/update handling.
-    assertWorkflowsEnabled();
     if (!schedule.workflowName) {
       throw new BadRequestError("Workflow schedule has no workflowName");
     }

package/src/runtime/routes/secret-routes.ts

@@ -26,6 +26,7 @@ import { setSentryOrganizationId, setSentryUserId } from "../../instrument.js";
 import { clearEmbeddingBackendCache } from "../../memory/embedding-backend.js";
 import { syncManualTokenConnection } from "../../oauth/manual-token-connection.js";
 import { validateAnthropicApiKey } from "../../providers/anthropic/client.js";
+import { validateAtlasCloudApiKey } from "../../providers/atlascloud/client.js";
 import { validateGeminiApiKey } from "../../providers/gemini/client.js";
 import { validateMinimaxApiKey } from "../../providers/minimax/client.js";
 import { validateOpenAIApiKey } from "../../providers/openai/client.js";
@@ -206,6 +207,15 @@ async function handleAddSecret({ body }: RouteHandlerArgs) {
           );
           return { success: false, error: validation.reason };
         }
+      } else if (name === "atlascloud") {
+        const validation = await validateAtlasCloudApiKey(value);
+        if (!validation.valid) {
+          log.warn(
+            { provider: name, reason: validation.reason },
+            "API key validation failed",
+          );
+          return { success: false, error: validation.reason };
+        }
       }
 
       const stored = await setSecureKeyAsync(

package/src/runtime/routes/surface-action-routes.ts

@@ -13,6 +13,7 @@ import type { ChannelId } from "../../channels/types.js";
 import { isHttpAuthDisabled } from "../../config/env.js";
 import { findGuardianForChannel } from "../../contacts/contact-store.js";
 import { getLogger } from "../../util/logger.js";
+import type { TrustClass } from "../actor-trust-resolver.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { processGuardianDecision } from "../guardian-action-service.js";
@@ -47,7 +48,7 @@ const log = getLogger("surface-action-routes");
 function applyTrustContext(
   conversation: {
     setTrustContext?(ctx: {
-      trustClass: "guardian" | "trusted_contact" | "unknown";
+      trustClass: TrustClass;
       sourceChannel: ChannelId;
     }): void;
   },

package/src/runtime/routes/tool-call-question-enrichment.test.ts

@@ -0,0 +1,146 @@
+/**
+ * Tests for render-time enrichment of history tool calls with the in-flight
+ * `ask_question` prompt read from the pending-interactions registry.
+ */
+import { afterEach, describe, expect, test } from "bun:test";
+
+import type { QuestionEntry } from "../../api/events/question-request.js";
+import type { ConversationMessageToolCall } from "../../api/responses/conversation-message.js";
+import { clear, register } from "../pending-interactions.js";
+import {
+  collectPendingQuestions,
+  enrichToolCallsWithQuestion,
+} from "./tool-call-question-enrichment.js";
+
+function toolCall(
+  overrides: Partial<ConversationMessageToolCall>,
+): ConversationMessageToolCall {
+  return {
+    name: "ask_question",
+    input: {},
+    ...overrides,
+  };
+}
+
+const ENTRIES: QuestionEntry[] = [
+  {
+    id: "q1",
+    question: "What's the email about?",
+    options: [
+      { id: "a", label: "iOS app is live" },
+      { id: "b", label: "Open source" },
+    ],
+  },
+];
+
+afterEach(() => {
+  clear();
+});
+
+describe("collectPendingQuestions", () => {
+  test("keys question interactions by toolUseId", () => {
+    // GIVEN a question interaction registered for a conversation with a
+    // tool-use id and the full question entries
+    register("req-1", {
+      conversationId: "conv-1",
+      kind: "question",
+      toolUseId: "tool-abc",
+      questionDetails: { entries: ENTRIES },
+    });
+
+    // WHEN we collect the conversation's pending questions
+    const byToolUseId = collectPendingQuestions("conv-1");
+
+    // THEN the interaction is keyed by its tool-use id
+    expect(byToolUseId.size).toBe(1);
+    expect(byToolUseId.get("tool-abc")?.requestId).toBe("req-1");
+    expect(byToolUseId.get("tool-abc")?.entries).toEqual(ENTRIES);
+  });
+
+  test("ignores interactions lacking a toolUseId, details, or the question kind", () => {
+    // GIVEN a question without a toolUseId, a question without details, AND a
+    // non-question interaction in the same conversation
+    register("req-no-tool", {
+      conversationId: "conv-2",
+      kind: "question",
+      questionDetails: { entries: ENTRIES },
+    });
+    register("req-no-details", {
+      conversationId: "conv-2",
+      kind: "question",
+      toolUseId: "tool-no-details",
+    });
+    register("req-confirmation", {
+      conversationId: "conv-2",
+      kind: "confirmation",
+      toolUseId: "tool-xyz",
+      confirmationDetails: {
+        toolName: "file_read",
+        input: {},
+        riskLevel: "low",
+        allowlistOptions: [],
+        scopeOptions: [],
+      },
+    });
+
+    // WHEN we collect the conversation's pending questions
+    const byToolUseId = collectPendingQuestions("conv-2");
+
+    // THEN none is included
+    expect(byToolUseId.size).toBe(0);
+  });
+});
+
+describe("enrichToolCallsWithQuestion", () => {
+  test("stamps the pending question when the registry has a match", () => {
+    // GIVEN a registry entry matching the tool call by id
+    register("req-1", {
+      conversationId: "conv-fixture",
+      kind: "question",
+      toolUseId: "tool-abc",
+      questionDetails: { entries: ENTRIES },
+    });
+    const pendingQuestions = collectPendingQuestions("conv-fixture");
+    const calls = [toolCall({ id: "tool-abc" })];
+
+    // WHEN we enrich it
+    const [enriched] = enrichToolCallsWithQuestion(calls, { pendingQuestions });
+
+    // THEN the outstanding prompt is projected onto the tool call so a cold
+    // reconnect can rehydrate the question card
+    expect(enriched?.pendingQuestion?.requestId).toBe("req-1");
+    expect(enriched?.pendingQuestion?.entries).toEqual(ENTRIES);
+  });
+
+  test("leaves tool calls without a match untouched (same reference)", () => {
+    // GIVEN a tool call with no matching registry entry
+    const original = toolCall({ id: "tool-unmatched" });
+    register("req-other", {
+      conversationId: "conv-fixture",
+      kind: "question",
+      toolUseId: "tool-abc",
+      questionDetails: { entries: ENTRIES },
+    });
+
+    // WHEN we enrich it
+    const [enriched] = enrichToolCallsWithQuestion([original], {
+      pendingQuestions: collectPendingQuestions("conv-fixture"),
+    });
+
+    // THEN the tool call is returned unchanged
+    expect(enriched).toBe(original);
+  });
+
+  test("returns the input array untouched when there are no pending questions", () => {
+    // GIVEN tool calls and an empty registry
+    const calls = [toolCall({ id: "tool-abc" })];
+
+    // WHEN we enrich with an empty lookup
+    const enriched = enrichToolCallsWithQuestion(calls, {
+      pendingQuestions: new Map(),
+    });
+
+    // THEN the original array is returned
+    expect(enriched).toBe(calls);
+  });
+});

package/src/runtime/routes/tool-call-question-enrichment.ts

@@ -0,0 +1,66 @@
+/**
+ * Render-time enrichment of history tool calls with in-flight question context.
+ *
+ * `pendingQuestion` — the outstanding `ask_question` prompt for a tool call
+ * still awaiting a user answer — is read from the in-memory
+ * `pending-interactions` registry (the authoritative store of unresolved
+ * prompts) and stamped onto its tool call so the web/API clients can restore
+ * the same question card on a cold reconnect (or a history reopen after the
+ * live event buffer has aged out) that the live `question_request` SSE stream
+ * would have produced. It appears only while the prompt is genuinely
+ * outstanding. Mirrors the confirmation enrichment in
+ * `tool-call-confirmation-enrichment.ts`.
+ */
+
+import type { QuestionEntry } from "../../api/events/question-request.js";
+import type { ConversationMessageToolCall } from "../../api/responses/conversation-message.js";
+import { getByConversation } from "../pending-interactions.js";
+
+/** A pending question matched to the tool call it prompts for, keyed by `toolUseId`. */
+interface PendingQuestionMatch {
+  requestId: string;
+  entries: QuestionEntry[];
+}
+
+/**
+ * Build the `toolUseId → pending question` lookup for a conversation from the
+ * registry. Only question interactions that carry both a `toolUseId` and
+ * `questionDetails` can be stamped onto a wire tool call.
+ */
+export function collectPendingQuestions(
+  conversationId: string,
+): Map<string, PendingQuestionMatch> {
+  const byToolUseId = new Map<string, PendingQuestionMatch>();
+  for (const interaction of getByConversation(conversationId)) {
+    if (
+      interaction.kind === "question" &&
+      interaction.questionDetails &&
+      interaction.toolUseId
+    ) {
+      byToolUseId.set(interaction.toolUseId, {
+        requestId: interaction.requestId,
+        entries: interaction.questionDetails.entries,
+      });
+    }
+  }
+  return byToolUseId;
+}
+
+/**
+ * Layer any outstanding `pendingQuestion` onto a message's rendered tool calls.
+ * Returns a new array; tool calls without a match are returned unchanged.
+ */
+export function enrichToolCallsWithQuestion(
+  toolCalls: ConversationMessageToolCall[],
+  opts: { pendingQuestions: ReadonlyMap<string, PendingQuestionMatch> },
+): ConversationMessageToolCall[] {
+  if (opts.pendingQuestions.size === 0) return toolCalls;
+  return toolCalls.map((tc) => {
+    const match = tc.id ? opts.pendingQuestions.get(tc.id) : undefined;
+    if (!match) return tc;
+    return {
+      ...tc,
+      pendingQuestion: { requestId: match.requestId, entries: match.entries },
+    };
+  });
+}