@vellumai/assistant 0.10.0 → 0.10.1-dev.202606240317.ea25efe

package/src/__tests__/app-source-watcher.test.ts

@@ -3,14 +3,7 @@
  * file changes and triggers debounced recompile + surface refresh.
  */
 
-import {
-  afterEach,
-  beforeEach,
-  describe,
-  expect,
-  mock,
-  test,
-} from "bun:test";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 // ---------------------------------------------------------------------------
 // Mocks — must be set up before importing the module under test
@@ -19,8 +12,16 @@ import {
 const TEST_APPS_DIR = "/tmp/test-apps";
 const testDirNameMap = new Map<string, string>([["my-app", "app-id-1"]]);
 
-let capturedWatchCallback: ((eventType: string, filename: string | null) => void) | null = null;
-const mockWatcher = { close: mock(() => {}) };
+let capturedWatchCallback:
+  | ((eventType: string, filename: string | null) => void)
+  | null = null;
+let capturedErrorHandler: ((err: unknown) => void) | null = null;
+const mockWatcher = {
+  close: mock(() => {}),
+  on: mock((event: string, handler: (err: unknown) => void) => {
+    if (event === "error") capturedErrorHandler = handler;
+  }),
+};
 const mockExistsSync = mock((p: string): boolean => p === TEST_APPS_DIR);
 const mockWatch = mock(
   (
@@ -68,7 +69,9 @@ describe("AppSourceWatcher", () => {
     watcher = new AppSourceWatcher();
     onChangeSpy = mock(() => {});
     capturedWatchCallback = null;
+    capturedErrorHandler = null;
     mockWatcher.close.mockClear();
+    mockWatcher.on.mockClear();
     // Reset existsSync to default behavior for each test
     mockExistsSync.mockImplementation((p: string) => p === TEST_APPS_DIR);
   });
@@ -182,4 +185,21 @@ describe("AppSourceWatcher", () => {
     watcher.ensureStarted();
     expect(mockWatch.mock.calls.length).toBe(callCountAfterStart); // no extra watch call
   });
+
+  /**
+   * REGRESSION: a recursive watch over a large app tree (node_modules) can
+   * exhaust the inotify watch limit and emit ENOSPC asynchronously as an
+   * 'error' event. Without an 'error' listener that rethrows as an
+   * uncaughtException and crashes the daemon. The watcher must swallow it.
+   */
+  test("attaches an 'error' handler that does not rethrow on async ENOSPC", () => {
+    watcher.start(onChangeSpy);
+
+    expect(capturedErrorHandler).not.toBeNull();
+    const enospc = Object.assign(
+      new Error("ENOSPC: no space left on device, watch"),
+      { code: "ENOSPC", errno: -28, syscall: "watch" },
+    );
+    expect(() => capturedErrorHandler!(enospc)).not.toThrow();
+  });
 });

package/src/__tests__/approval-cascade.test.ts

@@ -170,6 +170,12 @@ mock.module("../memory/retriever.js", () => ({
 
 mock.module("../plugins/defaults/compaction/window-manager.js", () => ({
   ContextWindowManager: class {
+    estimateInputTokens() {
+      return 0;
+    }
+    get tokenCountInputs() {
+      return { systemPrompt: "", tools: undefined };
+    }
     constructor() {}
     updateConfig() {}
     shouldCompact() {

package/src/__tests__/approval-interception-trust-gates.test.ts

@@ -0,0 +1,151 @@
+/**
+ * Trust-class gates in `handleApprovalInterception`.
+ *
+ * The interception dispatcher applies identity-based gates before any decision
+ * is resolved:
+ *  - An unverified sender (no established identity) auto-denies a pending
+ *    approval — a missing-identity actor must not be able to leave a sensitive
+ *    request actionable.
+ *  - An identity-known non-guardian must NOT auto-deny; it waits for the
+ *    guardian and receives a "pending" notice.
+ */
+
+import { beforeEach, describe, expect, mock, spyOn, test } from "bun:test";
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+const _conversationMocks = new Map<string, unknown>();
+mock.module("../daemon/conversation-registry.js", () => ({
+  findConversation: (id: string) => _conversationMocks.get(id),
+}));
+
+import type { Conversation } from "../daemon/conversation.js";
+import type { TrustContext } from "../daemon/trust-context.js";
+import { initializeDb } from "../memory/db-init.js";
+import * as approvalMessageComposer from "../runtime/approval-message-composer.js";
+import * as gatewayClient from "../runtime/gateway-client.js";
+import * as pendingInteractions from "../runtime/pending-interactions.js";
+import { handleApprovalInterception } from "../runtime/routes/guardian-approval-interception.js";
+
+await initializeDb();
+
+const ASSISTANT_ID = "self";
+const CONVERSATION_ID = "conv-1";
+const REQUESTER_CHAT = "requester-chat-1";
+const TOOL_NAME = "execute_shell";
+const TOOL_INPUT = { command: "rm -rf /tmp/test" };
+
+function registerPendingInteraction(
+  requestId: string,
+  conversationId: string,
+  toolName: string,
+  input: Record<string, unknown> = TOOL_INPUT,
+): ReturnType<typeof mock> {
+  const handleConfirmationResponse = mock(() => {});
+  const _mockSession = {
+    handleConfirmationResponse,
+    ensureActorScopedHistory: async () => {},
+  } as unknown as Conversation;
+  _conversationMocks.set(conversationId, _mockSession);
+
+  pendingInteractions.register(requestId, {
+    conversationId,
+    kind: "confirmation",
+    confirmationDetails: {
+      toolName,
+      input,
+      riskLevel: "high",
+      allowlistOptions: [
+        { label: "test", description: "test", pattern: "test" },
+      ],
+      scopeOptions: [{ label: "everywhere", scope: "everywhere" }],
+    },
+  });
+
+  return handleConfirmationResponse;
+}
+
+describe("approval interception trust-class gates", () => {
+  let deliverSpy: ReturnType<typeof spyOn>;
+  let composeSpy: ReturnType<typeof spyOn>;
+
+  beforeEach(() => {
+    pendingInteractions.clear();
+    deliverSpy = spyOn(gatewayClient, "deliverChannelReply").mockResolvedValue({
+      ok: true,
+    });
+    composeSpy = spyOn(
+      approvalMessageComposer,
+      "composeApprovalMessageGenerative",
+    ).mockResolvedValue("test message");
+  });
+
+  test("identity-known unknown sender does not auto-deny pending approval", async () => {
+    const sessionMock = registerPendingInteraction(
+      "req-unknown-no-auto-deny-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      content: "approve",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "intruder-user-1",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "unknown",
+        requesterExternalUserId: "intruder-user-1",
+        guardianExternalUserId: "guardian-1",
+      } as TrustContext,
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("assistant_turn");
+    expect(sessionMock).not.toHaveBeenCalled();
+
+    deliverSpy.mockRestore();
+    composeSpy.mockRestore();
+  });
+
+  test("unverified sender (no identity) auto-denies pending approval", async () => {
+    const sessionMock = registerPendingInteraction(
+      "req-unknown-auto-deny-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      content: "approve",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: undefined,
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "unknown",
+      } as TrustContext,
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("decision_applied");
+    expect(sessionMock).toHaveBeenCalled();
+    expect(sessionMock.mock.calls[0]?.[0]).toBe("req-unknown-auto-deny-1");
+    expect(sessionMock.mock.calls[0]?.[1]).toBe("deny");
+
+    deliverSpy.mockRestore();
+    composeSpy.mockRestore();
+  });
+});

package/src/__tests__/approval-primitive.test.ts

@@ -18,7 +18,7 @@ import { initializeDb } from "../memory/db-init.js";
 import { scopedApprovalGrants } from "../memory/schema.js";
 import { computeToolApprovalDigest } from "../security/tool-approval-digest.js";
 
-initializeDb();
+await initializeDb();
 
 function clearTables(): void {
   const db = getDb();

package/src/__tests__/approval-routes-http.test.ts

@@ -145,7 +145,7 @@ import { AssistantEventHub } from "../runtime/assistant-event-hub.js";
 import { RuntimeHttpServer } from "../runtime/http-server.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 
-initializeDb();
+await initializeDb();
 
 // ---------------------------------------------------------------------------
 // Conversation helpers

package/src/__tests__/assistant-attachments.test.ts

@@ -8,8 +8,10 @@ import {
   deduplicateDrafts,
   drainDirectiveDisplayBuffer,
   estimateBase64Bytes,
+  extractVellumLinks,
   inferMimeType,
   MAX_ASSISTANT_ATTACHMENT_BYTES,
+  stripVellumLinks,
   validateDrafts,
 } from "../daemon/assistant-attachments.js";
 
@@ -330,6 +332,159 @@ describe("cleanAssistantContent", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// extractVellumLinks
+// ---------------------------------------------------------------------------
+
+describe("extractVellumLinks", () => {
+  test("extracts workspace links", () => {
+    const text =
+      "Here is your report: [report.pdf](vellum://workspace/scratch/report.pdf)";
+    const result = extractVellumLinks(text);
+
+    expect(result.directiveRequests).toHaveLength(1);
+    expect(result.directiveRequests[0].source).toBe("sandbox");
+    expect(result.directiveRequests[0].path).toBe("scratch/report.pdf");
+    expect(result.directiveRequests[0].filename).toBe("report.pdf");
+  });
+
+  test("extracts host links", () => {
+    const text = "[doc.pdf](vellum://host/Users/me/doc.pdf)";
+    const result = extractVellumLinks(text);
+
+    expect(result.directiveRequests).toHaveLength(1);
+    expect(result.directiveRequests[0].source).toBe("host");
+    expect(result.directiveRequests[0].path).toBe("/Users/me/doc.pdf");
+    expect(result.directiveRequests[0].filename).toBe("doc.pdf");
+  });
+
+  test("extracts multiple links", () => {
+    const text = [
+      "Here are the files:",
+      "[a.png](vellum://workspace/scratch/a.png)",
+      "[b.pdf](vellum://host/tmp/b.pdf)",
+    ].join("\n");
+    const result = extractVellumLinks(text);
+
+    expect(result.directiveRequests).toHaveLength(2);
+    expect(result.directiveRequests[0].source).toBe("sandbox");
+    expect(result.directiveRequests[0].path).toBe("scratch/a.png");
+    expect(result.directiveRequests[1].source).toBe("host");
+    expect(result.directiveRequests[1].path).toBe("/tmp/b.pdf");
+  });
+
+  test("warns on empty workspace path", () => {
+    const text = "[file](vellum://workspace/)";
+    const result = extractVellumLinks(text);
+
+    expect(result.directiveRequests).toHaveLength(0);
+    expect(result.parseWarnings).toHaveLength(1);
+    expect(result.parseWarnings[0]).toContain("empty path");
+  });
+
+  test("warns on empty host path", () => {
+    const text = "[file](vellum://host/)";
+    const result = extractVellumLinks(text);
+
+    expect(result.directiveRequests).toHaveLength(0);
+    expect(result.parseWarnings).toHaveLength(1);
+    expect(result.parseWarnings[0]).toContain("empty path");
+  });
+
+  test("ignores non-vellum markdown links", () => {
+    const text = "[link](https://example.com)";
+    const result = extractVellumLinks(text);
+
+    expect(result.directiveRequests).toHaveLength(0);
+    expect(result.parseWarnings).toHaveLength(0);
+  });
+
+  test("returns empty when no links present", () => {
+    const text = "Just some plain text with no links.";
+    const result = extractVellumLinks(text);
+
+    expect(result.directiveRequests).toHaveLength(0);
+    expect(result.parseWarnings).toHaveLength(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// cleanAssistantContent — vellum:// links
+// ---------------------------------------------------------------------------
+
+// ---------------------------------------------------------------------------
+// stripVellumLinks
+// ---------------------------------------------------------------------------
+
+describe("stripVellumLinks", () => {
+  test("replaces vellum:// links with their link text", () => {
+    const text =
+      "Here is the file: [report.pdf](vellum://workspace/scratch/report.pdf)";
+    expect(stripVellumLinks(text)).toBe("Here is the file: report.pdf");
+  });
+
+  test("handles multiple links", () => {
+    const text = [
+      "[a.png](vellum://workspace/scratch/a.png)",
+      "[b.pdf](vellum://host/tmp/b.pdf)",
+    ].join(" and ");
+    expect(stripVellumLinks(text)).toBe("a.png and b.pdf");
+  });
+
+  test("preserves text with no vellum links", () => {
+    const text = "Plain text with [link](https://example.com)";
+    expect(stripVellumLinks(text)).toBe(text);
+  });
+
+  test("handles link text that differs from path basename", () => {
+    const text = "[Quarterly Report](vellum://workspace/scratch/report.pdf)";
+    expect(stripVellumLinks(text)).toBe("Quarterly Report");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// cleanAssistantContent — vellum:// links
+// ---------------------------------------------------------------------------
+
+describe("cleanAssistantContent — vellum links", () => {
+  test("extracts vellum:// links as directives without stripping them", () => {
+    const content = [
+      {
+        type: "text",
+        text: "Here is your file: [report.pdf](vellum://workspace/scratch/report.pdf)",
+      },
+    ];
+    const result = cleanAssistantContent(content);
+
+    expect(result.directives).toHaveLength(1);
+    expect(result.directives[0].source).toBe("sandbox");
+    expect(result.directives[0].path).toBe("scratch/report.pdf");
+    // The link text is preserved (not stripped)
+    expect((result.cleanedContent[0] as { text: string }).text).toContain(
+      "[report.pdf](vellum://workspace/scratch/report.pdf)",
+    );
+  });
+
+  test("handles both vellum links and legacy tags in the same text", () => {
+    const content = [
+      {
+        type: "text",
+        text: '[report.pdf](vellum://workspace/scratch/report.pdf)\n<vellum-attachment path="extra.png" />',
+      },
+    ];
+    const result = cleanAssistantContent(content);
+
+    expect(result.directives).toHaveLength(2);
+    // vellum link is preserved, legacy tag is stripped
+    expect((result.cleanedContent[0] as { text: string }).text).toContain(
+      "[report.pdf](vellum://workspace/scratch/report.pdf)",
+    );
+    expect((result.cleanedContent[0] as { text: string }).text).not.toContain(
+      "<vellum-attachment",
+    );
+  });
+});
+
 // ---------------------------------------------------------------------------
 // drainDirectiveDisplayBuffer
 // ---------------------------------------------------------------------------

package/src/__tests__/assistant-event-hub-machine-name.test.ts

@@ -29,7 +29,7 @@ import { initializeDb } from "../memory/db-init.js";
 import { AssistantEventHub } from "../runtime/assistant-event-hub.js";
 import { handleSubscribeAssistantEvents } from "../runtime/routes/events-routes.js";
 
-initializeDb();
+await initializeDb();
 
 describe("AssistantEventHub — machineName", () => {
   test("subscribing with machineName returns it from listClients()", () => {
@@ -72,9 +72,7 @@ describe("AssistantEventHub — machineName", () => {
     );
 
     const clients = hub.listClients();
-    const entry = clients.find(
-      (c) => c.clientId === "client-without-name-001",
-    );
+    const entry = clients.find((c) => c.clientId === "client-without-name-001");
     expect(entry).toBeDefined();
     expect(entry?.machineName).toBeUndefined();
 

package/src/__tests__/assistant-events-sse-hardening.test.ts

@@ -35,7 +35,7 @@ import { AssistantEventHub } from "../runtime/assistant-event-hub.js";
 import { ServiceUnavailableError } from "../runtime/routes/errors.js";
 import { handleSubscribeAssistantEvents } from "../runtime/routes/events-routes.js";
 
-initializeDb();
+await initializeDb();
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
 

package/src/__tests__/assistant-events-sse-shed.test.ts

@@ -21,7 +21,7 @@ import {
   type SseSubscriberInstrumentation,
 } from "../runtime/routes/events-routes.js";
 
-initializeDb();
+await initializeDb();
 
 function clearTables() {
   const db = getDb();

package/src/__tests__/attachment-upload-trusted-source.test.ts

@@ -26,7 +26,10 @@ mock.module("../config/env.js", () => ({
 }));
 
 import { initializeDb } from "../memory/db-init.js";
-import { ROUTES } from "../runtime/routes/attachment-routes.js";
+import {
+  attachmentMetadataSchema,
+  ROUTES,
+} from "../runtime/routes/attachment-routes.js";
 import { RouteError } from "../runtime/routes/errors.js";
 import type { RouteHandlerArgs } from "../runtime/routes/types.js";
 
@@ -52,8 +55,8 @@ function makeUploadArgs(
 }
 
 describe("attachment upload — trustedSource flag", () => {
-  beforeAll(() => {
-    initializeDb();
+  beforeAll(async () => {
+    await initializeDb();
   });
 
   beforeEach(() => {
@@ -62,7 +65,7 @@ describe("attachment upload — trustedSource flag", () => {
   });
 
   test("svc_gateway + trustedSource:true accepts a non-allowlisted MIME type", async () => {
-    const result = (await uploadRoute.handler(
+    const raw = await uploadRoute.handler(
       makeUploadArgs(
         {
           filename: "clip.mkv",
@@ -72,14 +75,15 @@ describe("attachment upload — trustedSource flag", () => {
         },
         "svc_gateway",
       ),
-    )) as { id: string; mime_type: string };
+    );
+    const result = attachmentMetadataSchema.parse(raw);
 
     expect(result.id).toBeDefined();
-    expect(result.mime_type).toBe("video/x-matroska");
+    expect(result.mimeType).toBe("video/x-matroska");
   });
 
   test("svc_gateway + trustedSource:true accepts a dangerous extension", async () => {
-    const result = (await uploadRoute.handler(
+    const raw = await uploadRoute.handler(
       makeUploadArgs(
         {
           filename: "installer.dmg",
@@ -89,7 +93,8 @@ describe("attachment upload — trustedSource flag", () => {
         },
         "svc_gateway",
       ),
-    )) as { id: string };
+    );
+    const result = attachmentMetadataSchema.parse(raw);
 
     expect(result.id).toBeDefined();
   });

package/src/__tests__/attachments-store.test.ts

@@ -42,7 +42,7 @@ import { initializeDb } from "../memory/db-init.js";
 import { rawGet, rawRun } from "../memory/raw-query.js";
 import { getConversationsDir } from "../util/platform.js";
 
-initializeDb();
+await initializeDb();
 
 function resetTables() {
   const db = getDb();

package/src/__tests__/audit-log-rotation.test.ts

@@ -56,9 +56,9 @@ const ONE_DAY_MS = 24 * 60 * 60 * 1000;
 // ---------------------------------------------------------------------------
 
 describe("audit log rotation", () => {
-  beforeAll(() => {
+  beforeAll(async () => {
     resetDbForTesting();
-    initializeDb();
+    await initializeDb();
     // Insert a conversations row so FK-enforced ORM inserts succeed
     getSqlite().run(
       `INSERT INTO conversations (id, title, created_at, updated_at) VALUES ('conv-1', 'test', ${Date.now()}, ${Date.now()})`,
@@ -138,57 +138,53 @@ describe("audit log rotation", () => {
     expect(getRecentInvocations(100).length).toBe(1);
   });
 
-  test(
-    "yields to the event loop while the purge is in flight (anti-block)",
-    async () => {
-      // Seed a few thousand rows so the DELETE has measurable
-      // subprocess work behind the scenes.
-      const ROW_COUNT = 2000;
-      const past = 100 * ONE_DAY_MS;
-      const sqlite = getSqlite();
-      sqlite.exec("BEGIN");
-      try {
-        for (let i = 0; i < ROW_COUNT; i++) {
-          addInvocation(past);
-        }
-        sqlite.exec("COMMIT");
-      } catch (err) {
-        sqlite.exec("ROLLBACK");
-        throw err;
+  test("yields to the event loop while the purge is in flight (anti-block)", async () => {
+    // Seed a few thousand rows so the DELETE has measurable
+    // subprocess work behind the scenes.
+    const ROW_COUNT = 2000;
+    const past = 100 * ONE_DAY_MS;
+    const sqlite = getSqlite();
+    sqlite.exec("BEGIN");
+    try {
+      for (let i = 0; i < ROW_COUNT; i++) {
+        addInvocation(past);
       }
-
-      // Race the purge against a `setImmediate` ping. The ping
-      // resolves on the very next event-loop iteration after it is
-      // scheduled.
-      //
-      // If the purge is async (subprocess), `rotateToolInvocations`
-      // returns a pending Promise immediately; the ping wins the race
-      // while the subprocess is still running.
-      //
-      // If the purge is ever regressed back to a synchronous DELETE,
-      // `rotateToolInvocations` blocks the main thread for the full
-      // DELETE duration. `setImmediate` cannot fire until the main
-      // thread releases, so the purge's already-resolved Promise
-      // beats the ping through the microtask queue and "purge" wins.
-      //
-      // The signal is deterministic regardless of how fast the
-      // subprocess is or how busy the event loop is.
-      const ping = new Promise<"ping">((resolve) =>
-        setImmediate(() => resolve("ping")),
-      );
-      const purgePromise = rotateToolInvocations(7);
-      const winner = await Promise.race([
-        ping,
-        purgePromise.then(() => "purge" as const),
-      ]);
-
-      expect(winner).toBe("ping");
-
-      // Drain the purge so the log + subprocess cleanup complete
-      // before the test exits.
-      const deleted = await purgePromise;
-      expect(deleted).toBe(ROW_COUNT);
-    },
-    60_000,
-  );
+      sqlite.exec("COMMIT");
+    } catch (err) {
+      sqlite.exec("ROLLBACK");
+      throw err;
+    }
+
+    // Race the purge against a `setImmediate` ping. The ping
+    // resolves on the very next event-loop iteration after it is
+    // scheduled.
+    //
+    // If the purge is async (subprocess), `rotateToolInvocations`
+    // returns a pending Promise immediately; the ping wins the race
+    // while the subprocess is still running.
+    //
+    // If the purge is ever regressed back to a synchronous DELETE,
+    // `rotateToolInvocations` blocks the main thread for the full
+    // DELETE duration. `setImmediate` cannot fire until the main
+    // thread releases, so the purge's already-resolved Promise
+    // beats the ping through the microtask queue and "purge" wins.
+    //
+    // The signal is deterministic regardless of how fast the
+    // subprocess is or how busy the event loop is.
+    const ping = new Promise<"ping">((resolve) =>
+      setImmediate(() => resolve("ping")),
+    );
+    const purgePromise = rotateToolInvocations(7);
+    const winner = await Promise.race([
+      ping,
+      purgePromise.then(() => "purge" as const),
+    ]);
+
+    expect(winner).toBe("ping");
+
+    // Drain the purge so the log + subprocess cleanup complete
+    // before the test exits.
+    const deleted = await purgePromise;
+    expect(deleted).toBe(ROW_COUNT);
+  }, 60_000);
 });

package/src/__tests__/auth-fallback-events-store.test.ts

@@ -22,7 +22,7 @@ import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import { authFallbackEvents } from "../memory/schema.js";
 
-initializeDb();
+await initializeDb();
 
 function resetTable(): void {
   getDb().delete(authFallbackEvents).run();