@vellumai/assistant 0.10.0 → 0.10.1-staging.1

package/src/runtime/routes/__tests__/channel-verification-revoke.test.ts

@@ -0,0 +1,277 @@
+/**
+ * Tests for the verification-revoke route relay.
+ *
+ * The revoke route downgrades the channel's ACL status through the gateway
+ * (source of truth) via `ipcCallPersistent("mark_channel_revoked", ...)` while
+ * keeping session teardown (`cancelOutbound`, `revokePendingSessions`)
+ * assistant-side. The gateway enforces the guardian guard; a rejected guardian
+ * downgrade surfaces here as a relayed IpcCallError.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { IpcCallError } from "@vellumai/gateway-client/ipc-client";
+
+type IpcCall = { method: string; params?: Record<string, unknown> };
+
+let ipcCalls: IpcCall[] = [];
+let ipcError: Error | undefined;
+
+const ipcCallPersistentMock = mock(
+  async (method: string, params?: Record<string, unknown>) => {
+    ipcCalls.push({ method, params });
+    if (ipcError) throw ipcError;
+    return {
+      ok: true,
+      didWrite: true,
+      channel: {
+        id: (params?.contactChannelId as string) ?? "ch1",
+        contactId: "c1",
+        type: "telegram",
+        address: "addr",
+        status: "revoked",
+        revokedReason: (params?.reason as string) ?? null,
+      },
+    };
+  },
+);
+
+const actualGatewayClient = await import("../../../ipc/gateway-client.js");
+mock.module("../../../ipc/gateway-client.js", () => ({
+  ...actualGatewayClient,
+  ipcCallPersistent: ipcCallPersistentMock,
+}));
+
+// Session teardown — assert these still run locally on every revoke.
+const cancelOutboundMock = mock((_args: { channel: string }) => {});
+const actualOutboundActions = await import(
+  "../../verification-outbound-actions.js"
+);
+mock.module("../../verification-outbound-actions.js", () => ({
+  ...actualOutboundActions,
+  cancelOutbound: cancelOutboundMock,
+}));
+
+const revokePendingSessionsMock = mock((_channel: string) => {});
+const revokeBindingMock = mock((_assistantId: string, _channel: string) => {
+  revokeGuardianBindingMock();
+  return true;
+});
+let guardianBinding:
+  | {
+      guardianExternalUserId: string;
+      guardianDeliveryChatId?: string;
+    }
+  | null = null;
+const actualVerificationService = await import(
+  "../../channel-verification-service.js"
+);
+mock.module("../../channel-verification-service.js", () => ({
+  ...actualVerificationService,
+  revokePendingSessions: revokePendingSessionsMock,
+  revokeBinding: revokeBindingMock,
+  getGuardianBinding: mock(() => guardianBinding),
+}));
+
+// Contact-store lookup that resolves the guardian's channel to downgrade.
+let contactChannel: { id: string; status: string } | null = null;
+const actualContactStore = await import("../../../contacts/contact-store.js");
+mock.module("../../../contacts/contact-store.js", () => ({
+  ...actualContactStore,
+  findContactChannel: mock(() =>
+    contactChannel ? { channel: contactChannel, contact: { id: "c1" } } : null,
+  ),
+}));
+
+// Guard: the contact-channel ACL write moves to the gateway relay and must
+// never run locally. The assistant-owned guardian-binding teardown
+// (revokeGuardianBinding) still runs locally — assert it is invoked.
+const localAclWrite = mock(() => {
+  throw new Error("local ACL write must not happen on relayed revoke");
+});
+const revokeGuardianBindingMock = mock(() => true);
+const actualContactsWrite = await import("../../../contacts/contacts-write.js");
+mock.module("../../../contacts/contacts-write.js", () => ({
+  ...actualContactsWrite,
+  revokeMember: localAclWrite,
+  revokeGuardianBinding: revokeGuardianBindingMock,
+}));
+
+// Contact-change invalidation — emitted explicitly on relay success so open
+// client views stop showing the channel as active (the gateway dual-write to
+// "revoked" precedes binding teardown, so revokeGuardianBinding no longer
+// fires it).
+const emitContactChangeMock = mock(() => {});
+const actualContactEvents = await import("../../../contacts/contact-events.js");
+mock.module("../../../contacts/contact-events.js", () => ({
+  ...actualContactEvents,
+  emitContactChange: emitContactChangeMock,
+}));
+
+const { ROUTES } = await import("../channel-verification-routes.js");
+
+const revokeHandler = ROUTES.find(
+  (r) => r.operationId === "channel_verification_sessions_revoke",
+)!.handler;
+
+describe("verification revoke relay", () => {
+  beforeEach(() => {
+    ipcCalls = [];
+    ipcError = undefined;
+    guardianBinding = {
+      guardianExternalUserId: "guardian-user",
+      guardianDeliveryChatId: "chat-1",
+    };
+    contactChannel = { id: "ch1", status: "active" };
+    ipcCallPersistentMock.mockClear();
+    cancelOutboundMock.mockClear();
+    revokePendingSessionsMock.mockClear();
+    revokeBindingMock.mockClear();
+    revokeGuardianBindingMock.mockClear();
+    localAclWrite.mockClear();
+    emitContactChangeMock.mockClear();
+  });
+
+  test("relays the downgrade outcome to the gateway and tears down sessions locally", async () => {
+    const result = (await revokeHandler({
+      body: { channel: "telegram" },
+    })) as { success: boolean; bound: boolean; channel: string };
+
+    // ACL downgrade relayed to the gateway (source of truth).
+    expect(ipcCalls).toEqual([
+      {
+        method: "mark_channel_revoked",
+        params: {
+          contactChannelId: "ch1",
+          reason: "guardian_binding_revoked",
+        },
+      },
+    ]);
+
+    // Session teardown stays assistant-side.
+    expect(cancelOutboundMock).toHaveBeenCalledTimes(1);
+    expect(revokePendingSessionsMock).toHaveBeenCalledTimes(1);
+
+    // Assistant-owned guardian binding torn down locally.
+    expect(revokeBindingMock).toHaveBeenCalledTimes(1);
+    expect(revokeGuardianBindingMock).toHaveBeenCalledTimes(1);
+
+    // The contact-channel ACL write does not fall back to the assistant.
+    expect(localAclWrite).not.toHaveBeenCalled();
+
+    // Invalidation emitted explicitly on relay success: the gateway dual-write
+    // to "revoked" precedes binding teardown, so revokeGuardianBinding's own
+    // emit no longer fires.
+    expect(emitContactChangeMock).toHaveBeenCalledTimes(1);
+
+    expect(result.success).toBe(true);
+    expect(result.bound).toBe(false);
+  });
+
+  test("emits the invalidation even when the gateway dual-write already revoked the channel", async () => {
+    // Simulate the gateway having dual-written the assistant row to "revoked"
+    // before binding teardown: findGuardianForChannel (active-only) now finds
+    // nothing, so revokeGuardianBinding is a no-op and never emits.
+    revokeGuardianBindingMock.mockImplementationOnce(() => false);
+
+    await revokeHandler({ body: { channel: "telegram" } });
+
+    expect(ipcCalls).toHaveLength(1);
+    expect(emitContactChangeMock).toHaveBeenCalledTimes(1);
+  });
+
+  test("malformed gateway response surfaces as an error", async () => {
+    // Deliberately malformed shape: must fail schema validation, not pass.
+    ipcCallPersistentMock.mockImplementationOnce(
+      async () => ({ ok: "nope" }) as never,
+    );
+
+    let thrown: Error | undefined;
+    try {
+      await revokeHandler({ body: { channel: "telegram" } });
+    } catch (err) {
+      thrown = err as Error;
+    }
+
+    expect(thrown).toBeDefined();
+    // Invalidation must not fire when the relay response is invalid.
+    expect(emitContactChangeMock).not.toHaveBeenCalled();
+    expect(revokeBindingMock).not.toHaveBeenCalled();
+  });
+
+  test("ok: false gateway response surfaces as an error", async () => {
+    ipcCallPersistentMock.mockImplementationOnce(async (_m, params) => ({
+      ok: false,
+      didWrite: false,
+      channel: {
+        id: (params?.contactChannelId as string) ?? "ch1",
+        contactId: "c1",
+        type: "telegram",
+        address: "addr",
+        status: "active",
+        revokedReason: "still_active",
+      },
+    }));
+
+    let thrown: Error | undefined;
+    try {
+      await revokeHandler({ body: { channel: "telegram" } });
+    } catch (err) {
+      thrown = err as Error;
+    }
+
+    expect(thrown).toBeDefined();
+    expect(emitContactChangeMock).not.toHaveBeenCalled();
+    expect(revokeBindingMock).not.toHaveBeenCalled();
+  });
+
+  test("guardian guard rejection from the gateway surfaces as an error", async () => {
+    ipcError = new IpcCallError("Cannot downgrade a guardian channel.", {
+      statusCode: 409,
+      errorCode: "CONFLICT",
+    });
+
+    let thrown: { statusCode?: number; message: string } | undefined;
+    try {
+      await revokeHandler({ body: { channel: "telegram" } });
+    } catch (err) {
+      thrown = err as { statusCode?: number; message: string };
+    }
+
+    expect(thrown).toBeDefined();
+    expect(thrown!.statusCode).toBe(409);
+    // Session teardown ran before the relay rejected; the binding teardown
+    // does not run when the gateway refuses the downgrade.
+    expect(cancelOutboundMock).toHaveBeenCalledTimes(1);
+    expect(revokePendingSessionsMock).toHaveBeenCalledTimes(1);
+    expect(revokeBindingMock).not.toHaveBeenCalled();
+    expect(localAclWrite).not.toHaveBeenCalled();
+  });
+
+  test("no binding present: tears down sessions and skips the relay", async () => {
+    guardianBinding = null;
+
+    const result = (await revokeHandler({
+      body: { channel: "telegram" },
+    })) as { success: boolean; bound: boolean };
+
+    expect(ipcCalls).toEqual([]);
+    expect(cancelOutboundMock).toHaveBeenCalledTimes(1);
+    expect(revokePendingSessionsMock).toHaveBeenCalledTimes(1);
+    expect(revokeBindingMock).not.toHaveBeenCalled();
+    expect(result.success).toBe(true);
+    expect(result.bound).toBe(false);
+  });
+
+  test("skips the relay when the resolved channel is already revoked", async () => {
+    contactChannel = { id: "ch1", status: "revoked" };
+
+    await revokeHandler({ body: { channel: "telegram" } });
+
+    expect(ipcCalls).toEqual([]);
+    expect(cancelOutboundMock).toHaveBeenCalledTimes(1);
+    expect(revokePendingSessionsMock).toHaveBeenCalledTimes(1);
+    // Binding teardown still runs even when the channel is already revoked.
+    expect(revokeBindingMock).toHaveBeenCalledTimes(1);
+  });
+});

package/src/runtime/routes/__tests__/channel-verification-routes.test.ts

@@ -0,0 +1,140 @@
+/**
+ * Tests for the trusted-contact branch of the channel-verification create
+ * route.
+ *
+ * Pins the invariant that the trusted-contact create path performs no
+ * assistant-side activation write (no `updateChannelStatus`): it only creates an
+ * outbound session and sends a code. The verified outcome flows exclusively
+ * through the inbound gateway code-match path, so it is never double-written.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+const verifyTrustedContactCalls: Array<[string, string]> = [];
+let verifyTrustedContactImpl: (
+  contactChannelId: string,
+  assistantId: string,
+) => Promise<Record<string, unknown>> = async () => ({ success: true });
+
+const updateChannelStatusCalls: unknown[] = [];
+const ipcCalls: Array<[string, unknown]> = [];
+
+mock.module("../../../daemon/handlers/config-channels.js", () => ({
+  verifyTrustedContact: async (contactChannelId: string, assistantId: string) => {
+    verifyTrustedContactCalls.push([contactChannelId, assistantId]);
+    return verifyTrustedContactImpl(contactChannelId, assistantId);
+  },
+  createInboundChallenge: () => ({ success: true }),
+  getVerificationStatus: () => ({ success: true }),
+  revokeVerificationForChannel: () => ({ success: true }),
+}));
+
+mock.module("../../../contacts/contact-store.js", () => ({
+  updateChannelStatus: (...args: unknown[]) => {
+    updateChannelStatusCalls.push(args);
+    return null;
+  },
+}));
+
+mock.module("../../ipc/gateway-client.js", () => ({
+  ipcCallPersistent: async (method: string, params: unknown) => {
+    ipcCalls.push([method, params]);
+    return { ok: true, didWrite: true, channel: {} };
+  },
+}));
+
+import { handleCreateVerificationSession } from "../channel-verification-routes.js";
+import { ConflictError, TooManyRequestsError } from "../errors.js";
+
+beforeEach(() => {
+  verifyTrustedContactCalls.length = 0;
+  updateChannelStatusCalls.length = 0;
+  ipcCalls.length = 0;
+  verifyTrustedContactImpl = async () => ({ success: true });
+});
+
+describe("handleCreateVerificationSession — trusted_contact", () => {
+  test("sends the verification session without writing the activation outcome assistant-side", async () => {
+    verifyTrustedContactImpl = async () => ({
+      success: true,
+      verificationSessionId: "sess-1",
+      expiresAt: Date.now() + 600_000,
+      sendCount: 1,
+      channel: "phone",
+    });
+
+    const result = (await handleCreateVerificationSession({
+      body: { purpose: "trusted_contact", contactChannelId: "cc-1" },
+    })) as Record<string, unknown>;
+
+    expect(result.success).toBe(true);
+    expect(result.verificationSessionId).toBe("sess-1");
+    expect(verifyTrustedContactCalls).toEqual([["cc-1", expect.any(String)]]);
+
+    // No assistant-side activation outcome write on the create path — the
+    // outcome flows through the inbound gateway code-match path instead.
+    expect(updateChannelStatusCalls).toEqual([]);
+  });
+
+  test("does not double-write the outcome via the gateway relay on the create path", async () => {
+    verifyTrustedContactImpl = async () => ({
+      success: true,
+      verificationSessionId: "sess-2",
+      channel: "telegram",
+    });
+
+    await handleCreateVerificationSession({
+      body: { purpose: "trusted_contact", contactChannelId: "cc-2" },
+    });
+
+    // The activation outcome is owned by the inbound gateway path; the create
+    // path must not relay a `mark_channel_verified` write (no double-write).
+    expect(
+      ipcCalls.filter(([method]) => method === "mark_channel_verified"),
+    ).toEqual([]);
+  });
+
+  test("propagates an already-verified short-circuit as a ConflictError (no silent success)", async () => {
+    verifyTrustedContactImpl = async () => ({
+      success: false,
+      error: "already_verified",
+      message: "Channel is already verified",
+    });
+
+    await expect(
+      handleCreateVerificationSession({
+        body: { purpose: "trusted_contact", contactChannelId: "cc-3" },
+      }),
+    ).rejects.toBeInstanceOf(ConflictError);
+
+    expect(updateChannelStatusCalls).toEqual([]);
+  });
+
+  test("propagates a rate-limit failure rather than silently succeeding", async () => {
+    verifyTrustedContactImpl = async () => ({
+      success: false,
+      error: "rate_limited",
+      message: "Too many attempts",
+    });
+
+    await expect(
+      handleCreateVerificationSession({
+        body: { purpose: "trusted_contact", contactChannelId: "cc-4" },
+      }),
+    ).rejects.toBeInstanceOf(TooManyRequestsError);
+  });
+
+  test("a failure in the trusted-contact path propagates, never a silent success", async () => {
+    verifyTrustedContactImpl = async () => {
+      throw new Error("gateway relay failed");
+    };
+
+    await expect(
+      handleCreateVerificationSession({
+        body: { purpose: "trusted_contact", contactChannelId: "cc-5" },
+      }),
+    ).rejects.toThrow("gateway relay failed");
+
+    expect(updateChannelStatusCalls).toEqual([]);
+  });
+});

package/src/runtime/routes/__tests__/connection-routes-vs-cli-parity.test.ts

@@ -29,13 +29,16 @@ mock.module("../../../util/logger.js", () => ({
 import { getDb } from "../../../memory/db-connection.js";
 import { initializeDb } from "../../../memory/db-init.js";
 import { providerConnections } from "../../../memory/schema/inference.js";
-import { createConnection, getConnection } from "../../../providers/inference/connections.js";
+import {
+  createConnection,
+  getConnection,
+} from "../../../providers/inference/connections.js";
 import { ROUTES } from "../inference-provider-connection-routes.js";
 import type { RouteDefinition } from "../types.js";
 
 // ── DB bootstrap ──────────────────────────────────────────────────────────────
 
-initializeDb();
+await initializeDb();
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
@@ -49,8 +52,14 @@ function clearConnections(): void {
   getDb().delete(providerConnections).run();
 }
 
-function normalizeTimestamps<T extends object>(obj: T): Omit<T, "createdAt" | "updatedAt"> {
-  const { createdAt: _c, updatedAt: _u, ...rest } = obj as T & { createdAt?: unknown; updatedAt?: unknown };
+function normalizeTimestamps<T extends object>(
+  obj: T,
+): Omit<T, "createdAt" | "updatedAt"> {
+  const {
+    createdAt: _c,
+    updatedAt: _u,
+    ...rest
+  } = obj as T & { createdAt?: unknown; updatedAt?: unknown };
   return rest as Omit<T, "createdAt" | "updatedAt">;
 }
 
@@ -79,7 +88,9 @@ describe("CLI vs HTTP route parity", () => {
     clearConnections();
 
     // ── HTTP route path ───────────────────────────────────────────────────────
-    const httpResult = (await findHandler("inference_provider_connections_create")({
+    const httpResult = (await findHandler(
+      "inference_provider_connections_create",
+    )({
       body: {
         name: payload.name,
         provider: payload.provider,
@@ -111,7 +122,11 @@ describe("CLI vs HTTP route parity", () => {
     clearConnections();
 
     await findHandler("inference_provider_connections_create")({
-      body: { name: payload.name, provider: payload.provider, auth: payload.auth },
+      body: {
+        name: payload.name,
+        provider: payload.provider,
+        auth: payload.auth,
+      },
     });
     const httpRow = getConnection(getDb(), payload.name);
 
@@ -133,7 +148,11 @@ describe("CLI vs HTTP route parity", () => {
     clearConnections();
 
     await findHandler("inference_provider_connections_create")({
-      body: { name: payload.name, provider: payload.provider, auth: payload.auth },
+      body: {
+        name: payload.name,
+        provider: payload.provider,
+        auth: payload.auth,
+      },
     });
     const httpRow = getConnection(getDb(), payload.name);
 

package/src/runtime/routes/__tests__/consolidation-routes.test.ts

@@ -38,14 +38,14 @@ mock.module("../../../util/logger.js", () => ({
 
 import { invalidateConfigCache } from "../../../config/loader.js";
 import { createConversation } from "../../../memory/conversation-crud.js";
-import { getDb } from "../../../memory/db-connection.js";
+import { getDb, getMemorySqlite } from "../../../memory/db-connection.js";
 import { initializeDb } from "../../../memory/db-init.js";
 import { recordUsageEvent } from "../../../memory/llm-usage-store.js";
-import { rawAll, rawRun } from "../../../memory/raw-query.js";
+import { rawRun } from "../../../memory/raw-query.js";
 import { ROUTES } from "../consolidation-routes.js";
 import type { RouteDefinition } from "../types.js";
 
-initializeDb();
+await initializeDb();
 
 let workspaceDir: string;
 let origWorkspaceDir: string | undefined;
@@ -56,7 +56,7 @@ function resetTables(): void {
   db.run(`DELETE FROM llm_usage_events`);
   db.run(`DELETE FROM messages`);
   db.run(`DELETE FROM conversations`);
-  db.run(`DELETE FROM memory_jobs`);
+  getMemorySqlite()!.run(`DELETE FROM memory_jobs`);
 }
 
 function findHandler(operationId: string): RouteDefinition["handler"] {
@@ -117,16 +117,20 @@ function readMemoryJobRows(): Array<{
   lastError: string | null;
   payload: string;
 }> {
-  return rawAll<{
+  return getMemorySqlite()!
+    .query(
+      `
+    SELECT id, status, last_error AS lastError, payload
+    FROM memory_jobs
+    ORDER BY id
+  `,
+    )
+    .all() as Array<{
     id: string;
     status: string;
     lastError: string | null;
     payload: string;
-  }>(`
-    SELECT id, status, last_error AS lastError, payload
-    FROM memory_jobs
-    ORDER BY id
-  `);
+  }>;
 }
 
 interface RunRecord {