@vellumai/assistant 0.10.1 → 0.10.2-dev.202606241651.2d2b40d

package/src/__tests__/host-file-routes-targeted.test.ts

@@ -87,7 +87,7 @@ afterAll(() => {
 
 const handleHostFileResult = ROUTES.find(
   (r) => r.endpoint === "host-file-result",
-)!.handler;
+)!.handler as (args: Record<string, unknown>) => Promise<unknown>;
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -189,15 +189,13 @@ describe("handleHostFileResult — targetClientId guard", () => {
       ).toThrow(BadRequestError);
     });
 
-    test("interaction is NOT resolved on 400 (still pending)", () => {
+    test("interaction is NOT resolved on 400 (still pending)", async () => {
       const requestId = "req-file-targeted-no-header-stays";
       registerPending(requestId, { targetClientId: "client-A" });
 
-      try {
-        handleHostFileResult({ body: fileBody(requestId) });
-      } catch {
+      await handleHostFileResult({ body: fileBody(requestId) }).catch(() => {
         // expected
-      }
+      });
 
       expect(resolvedIds).not.toContain(requestId);
       expect(pendingStore.has(requestId)).toBe(true);
@@ -219,19 +217,17 @@ describe("handleHostFileResult — targetClientId guard", () => {
       ).toThrow(ForbiddenError);
     });
 
-    test("ForbiddenError message names both submitting and expected client", () => {
+    test("ForbiddenError message names both submitting and expected client", async () => {
       const requestId = "req-file-targeted-mismatch-msg";
       registerPending(requestId, { targetClientId: "client-A" });
 
       let caught: unknown;
-      try {
-        handleHostFileResult({
-          body: fileBody(requestId),
-          headers: { "x-vellum-client-id": "client-B" },
-        });
-      } catch (e) {
+      await handleHostFileResult({
+        body: fileBody(requestId),
+        headers: { "x-vellum-client-id": "client-B" },
+      }).catch((e: unknown) => {
         caught = e;
-      }
+      });
 
       expect(caught).toBeInstanceOf(ForbiddenError);
       const msg = (caught as ForbiddenError).message;
@@ -239,18 +235,16 @@ describe("handleHostFileResult — targetClientId guard", () => {
       expect(msg).toContain("client-A");
     });
 
-    test("interaction is NOT consumed on 403 (pendingInteractions.get still returns it)", () => {
+    test("interaction is NOT consumed on 403 (pendingInteractions.get still returns it)", async () => {
       const requestId = "req-file-targeted-mismatch-stays";
       registerPending(requestId, { targetClientId: "client-A" });
 
-      try {
-        handleHostFileResult({
-          body: fileBody(requestId),
-          headers: { "x-vellum-client-id": "client-B" },
-        });
-      } catch {
+      await handleHostFileResult({
+        body: fileBody(requestId),
+        headers: { "x-vellum-client-id": "client-B" },
+      }).catch(() => {
         // expected
-      }
+      });
 
       expect(resolvedIds).not.toContain(requestId);
       expect(pendingStore.has(requestId)).toBe(true);
@@ -306,22 +300,20 @@ describe("handleHostFileResult — targetClientId guard", () => {
       ).toThrow(ForbiddenError);
     });
 
-    test("interaction is NOT consumed on actor-mismatch 403", () => {
+    test("interaction is NOT consumed on actor-mismatch 403", async () => {
       const requestId = "req-file-actor-mismatch-stays";
       clientActors.set("client-A", "actor-1");
       registerPending(requestId, { targetClientId: "client-A" });
 
-      try {
-        handleHostFileResult({
-          body: fileBody(requestId),
-          headers: {
-            "x-vellum-client-id": "client-A",
-            "x-vellum-actor-principal-id": "actor-2",
-          },
-        });
-      } catch {
+      await handleHostFileResult({
+        body: fileBody(requestId),
+        headers: {
+          "x-vellum-client-id": "client-A",
+          "x-vellum-actor-principal-id": "actor-2",
+        },
+      }).catch(() => {
         // expected
-      }
+      });
 
       expect(resolvedIds).not.toContain(requestId);
       expect(pendingStore.has(requestId)).toBe(true);
@@ -360,19 +352,17 @@ describe("handleHostFileResult — targetClientId guard", () => {
       ).toThrow(ForbiddenError);
     });
 
-    test("interaction is NOT consumed when submitting actor is missing", () => {
+    test("interaction is NOT consumed when submitting actor is missing", async () => {
       const requestId = "req-file-actor-missing-stays";
       clientActors.set("client-A", "actor-1");
       registerPending(requestId, { targetClientId: "client-A" });
 
-      try {
-        handleHostFileResult({
-          body: fileBody(requestId),
-          headers: { "x-vellum-client-id": "client-A" },
-        });
-      } catch {
+      await handleHostFileResult({
+        body: fileBody(requestId),
+        headers: { "x-vellum-client-id": "client-A" },
+      }).catch(() => {
         // expected
-      }
+      });
 
       expect(resolvedIds).not.toContain(requestId);
       expect(pendingStore.has(requestId)).toBe(true);
@@ -398,21 +388,19 @@ describe("handleHostFileResult — targetClientId guard", () => {
       ).toThrow(ForbiddenError);
     });
 
-    test("interaction is NOT consumed when target client has no stored actor", () => {
+    test("interaction is NOT consumed when target client has no stored actor", async () => {
       const requestId = "req-file-target-no-actor-stays";
       registerPending(requestId, { targetClientId: "client-A" });
 
-      try {
-        handleHostFileResult({
-          body: fileBody(requestId),
-          headers: {
-            "x-vellum-client-id": "client-A",
-            "x-vellum-actor-principal-id": "actor-1",
-          },
-        });
-      } catch {
+      await handleHostFileResult({
+        body: fileBody(requestId),
+        headers: {
+          "x-vellum-client-id": "client-A",
+          "x-vellum-actor-principal-id": "actor-1",
+        },
+      }).catch(() => {
         // expected
-      }
+      });
 
       expect(resolvedIds).not.toContain(requestId);
       expect(pendingStore.has(requestId)).toBe(true);

package/src/__tests__/host-transfer-routes-targeted.test.ts

@@ -99,7 +99,7 @@ afterAll(() => {
 
 const handleTransferContentGet = ROUTES.find(
   (r) => r.endpoint === "transfers/:transferId/content" && r.method === "GET",
-)!.handler;
+)!.handler as (args: Record<string, unknown>) => Promise<unknown>;
 
 const handleTransferContentPut = ROUTES.find(
   (r) => r.endpoint === "transfers/:transferId/content" && r.method === "PUT",
@@ -107,7 +107,7 @@ const handleTransferContentPut = ROUTES.find(
 
 const handleTransferResult = ROUTES.find(
   (r) => r.endpoint === "host-transfer-result",
-)!.handler;
+)!.handler as (args: Record<string, unknown>) => Promise<unknown>;
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -186,15 +186,13 @@ describe("handleTransferContentGet — Phase 3 targetClientId guard", () => {
       ).toThrow(BadRequestError);
     });
 
-    test("getTransferContent NOT called on 400", () => {
+    test("getTransferContent NOT called on 400", async () => {
       stubTargetClientId = "client-A";
-      try {
-        handleTransferContentGet({
-          pathParams: { transferId: TEST_TRANSFER_ID },
-        });
-      } catch {
+      await handleTransferContentGet({
+        pathParams: { transferId: TEST_TRANSFER_ID },
+      }).catch(() => {
         // expected
-      }
+      });
       expect(getTransferContentCalls).toHaveLength(0);
     });
   });
@@ -212,16 +210,14 @@ describe("handleTransferContentGet — Phase 3 targetClientId guard", () => {
       ).toThrow(ForbiddenError);
     });
 
-    test("getTransferContent NOT called on 403", () => {
+    test("getTransferContent NOT called on 403", async () => {
       stubTargetClientId = "client-A";
-      try {
-        handleTransferContentGet({
-          pathParams: { transferId: TEST_TRANSFER_ID },
-          headers: { "x-vellum-client-id": "client-B" },
-        });
-      } catch {
+      await handleTransferContentGet({
+        pathParams: { transferId: TEST_TRANSFER_ID },
+        headers: { "x-vellum-client-id": "client-B" },
+      }).catch(() => {
         // expected
-      }
+      });
       expect(getTransferContentCalls).toHaveLength(0);
     });
   });
@@ -526,23 +522,19 @@ describe("handleTransferResult — Phase 3 targetClientId guard", () => {
       );
     });
 
-    test("resolveTransferResult NOT called on 400", () => {
+    test("resolveTransferResult NOT called on 400", async () => {
       registerHostTransferPending("client-A");
-      try {
-        handleTransferResult({ body: resultBody() });
-      } catch {
+      await handleTransferResult({ body: resultBody() }).catch(() => {
         // expected
-      }
+      });
       expect(resolveTransferResultCalls).toHaveLength(0);
     });
 
-    test("pending interaction still present after 400", () => {
+    test("pending interaction still present after 400", async () => {
       registerHostTransferPending("client-A");
-      try {
-        handleTransferResult({ body: resultBody() });
-      } catch {
+      await handleTransferResult({ body: resultBody() }).catch(() => {
         // expected
-      }
+      });
       expect(pendingStore.has(TEST_REQUEST_ID)).toBe(true);
     });
   });
@@ -560,29 +552,25 @@ describe("handleTransferResult — Phase 3 targetClientId guard", () => {
       ).toThrow(ForbiddenError);
     });
 
-    test("resolveTransferResult NOT called on 403", () => {
+    test("resolveTransferResult NOT called on 403", async () => {
       registerHostTransferPending("client-A");
-      try {
-        handleTransferResult({
-          body: resultBody(),
-          headers: { "x-vellum-client-id": "client-B" },
-        });
-      } catch {
+      await handleTransferResult({
+        body: resultBody(),
+        headers: { "x-vellum-client-id": "client-B" },
+      }).catch(() => {
         // expected
-      }
+      });
       expect(resolveTransferResultCalls).toHaveLength(0);
     });
 
-    test("pending interaction still present after 403", () => {
+    test("pending interaction still present after 403", async () => {
       registerHostTransferPending("client-A");
-      try {
-        handleTransferResult({
-          body: resultBody(),
-          headers: { "x-vellum-client-id": "client-B" },
-        });
-      } catch {
+      await handleTransferResult({
+        body: resultBody(),
+        headers: { "x-vellum-client-id": "client-B" },
+      }).catch(() => {
         // expected
-      }
+      });
       expect(pendingStore.has(TEST_REQUEST_ID)).toBe(true);
     });
   });

package/src/__tests__/http-user-message-parity.test.ts

@@ -62,6 +62,21 @@ mock.module("../runtime/guardian-reply-router.js", () => ({
   routeGuardianReply: routeGuardianReplyMock,
 }));
 
+// Stub for the shared reset-drift helper. handleSendMessage only consumes its
+// result (a guardian TrustContext or null) on a first-pass-unknown actor; the
+// gate itself is covered in runtime/__tests__/guardian-vellum-migration.test.ts.
+const reResolveCalls: string[] = [];
+let mockReResolve: { trustClass: string; sourceChannel: string } | null = null;
+mock.module("../runtime/guardian-vellum-migration.js", () => ({
+  reResolveTrustOnResetDrift: async (
+    incomingPrincipalId: string,
+    _sourceChannel: string,
+  ) => {
+    reResolveCalls.push(incomingPrincipalId);
+    return mockReResolve;
+  },
+}));
+
 mock.module("../memory/canonical-guardian-store.js", () => ({
   createCanonicalGuardianRequest: () => ({
     id: "canonical-id",
@@ -94,6 +109,8 @@ mock.module("../runtime/confirmation-request-guardian-bridge.js", () => ({
 }));
 
 mock.module("../memory/conversation-crud.js", () => ({
+    setConversationProcessingStartedAt: () => {},
+    isConversationProcessing: () => false,
   addMessage: (
     conversationId: string,
     role: string,
@@ -104,17 +121,32 @@ mock.module("../memory/conversation-crud.js", () => ({
 }));
 
 mock.module("../runtime/local-actor-identity.js", () => ({
-  resolveLocalTrustContext: () => ({
-    trustClass: "guardian",
-    sourceChannel: "vellum",
-  }),
+  findLocalGuardianPrincipalId: async () =>
+    mockGuardians?.find(
+      (g) => g.channelType === "vellum" && g.status === "active",
+    )?.principalId as string | undefined,
+}));
+
+let mockGuardians: Array<Record<string, unknown>> | null = [
+  {
+    channelType: "vellum",
+    contactId: "guardian-contact",
+    principalId: "test-user",
+    address: "test-user",
+    status: "active",
+  },
+];
+
+mock.module("../contacts/guardian-delivery-reader.js", () => ({
+  getGuardianDelivery: async () => mockGuardians,
+  guardianForChannel: (
+    list: Array<Record<string, unknown>>,
+    channelType: string,
+  ) => list.find((g) => g.channelType === channelType && g.status === "active"),
 }));
 
+// handleSendMessage wraps the first-pass resolve with withSourceChannel.
 mock.module("../runtime/trust-context-resolver.js", () => ({
-  resolveTrustContext: () => ({
-    trustClass: "guardian",
-    sourceChannel: "vellum",
-  }),
   withSourceChannel: (sourceChannel: unknown, ctx: unknown) => ({
     ...(ctx as Record<string, unknown>),
     sourceChannel,
@@ -454,3 +486,130 @@ describe("HTTP POST /v1/messages clientTimezone transport metadata", () => {
     expect(runAgentLoop).toHaveBeenCalledTimes(1);
   });
 });
+
+// ============================================================================
+// TRUST CONTEXT — derived from the gateway guardian binding
+// ============================================================================
+describe("HTTP POST /v1/messages trust context from the gateway binding", () => {
+  beforeEach(() => {
+    mockGuardians = [
+      {
+        channelType: "vellum",
+        contactId: "guardian-contact",
+        principalId: "test-user",
+        address: "test-user",
+        status: "active",
+      },
+    ];
+    reResolveCalls.length = 0;
+    mockReResolve = null;
+  });
+
+  function requestAs(principalId: string, sourceChannel = "vellum") {
+    return new Request("http://localhost/v1/messages", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "x-vellum-actor-principal-id": principalId,
+        "x-vellum-principal-type": "actor",
+      },
+      body: JSON.stringify({
+        conversationKey: "trust-test-key",
+        content: "hi",
+        sourceChannel,
+        interface: "macos",
+      }),
+    });
+  }
+
+  async function trustContextFor(
+    principalId: string,
+    sourceChannel = "vellum",
+  ): Promise<Record<string, unknown>> {
+    let captured: Record<string, unknown> | undefined;
+    const conversation = makeConversation({
+      setTrustContext: (ctx: Record<string, unknown>) => {
+        captured = ctx;
+      },
+    });
+    const res = await callHandler(
+      (args) =>
+        handleSendMessage(args, {
+          sendMessageDeps: {
+            getOrCreateConversation: async () => conversation,
+            assistantEventHub: { publish: async () => {} } as any,
+            resolveAttachments: () => [],
+          },
+        }),
+      requestAs(principalId, sourceChannel),
+      undefined,
+      202,
+    );
+    expect(res.status).toBe(202);
+    return captured ?? {};
+  }
+
+  async function trustClassFor(principalId: string): Promise<string> {
+    return (await trustContextFor(principalId)).trustClass as string;
+  }
+
+  test("guardian principal resolves to guardian context, helper not called", async () => {
+    expect(await trustClassFor("test-user")).toBe("guardian");
+    expect(reResolveCalls).toEqual([]);
+  });
+
+  test("non-guardian principal: helper consulted, null result stays unknown", async () => {
+    mockReResolve = null;
+    expect(await trustClassFor("vellum-principal-stranger")).toBe("unknown");
+    expect(reResolveCalls).toEqual(["vellum-principal-stranger"]);
+  });
+
+  test("reset drift: helper returns guardian → route adopts it", async () => {
+    mockGuardians = [
+      {
+        channelType: "vellum",
+        contactId: "guardian-contact",
+        principalId: "vellum-principal-stale",
+        address: "vellum-principal-stale",
+        status: "active",
+      },
+    ];
+    mockReResolve = { trustClass: "guardian", sourceChannel: "vellum" };
+
+    expect(await trustClassFor("vellum-principal-healed")).toBe("guardian");
+    expect(reResolveCalls).toEqual(["vellum-principal-healed"]);
+  });
+
+  test("helper returns an unknown-class ctx → trust stays unknown (not adopted)", async () => {
+    mockGuardians = [
+      {
+        channelType: "vellum",
+        contactId: "guardian-contact",
+        principalId: "vellum-principal-stale",
+        address: "vellum-principal-stale",
+        status: "active",
+      },
+    ];
+    mockReResolve = { trustClass: "unknown", sourceChannel: "vellum" };
+
+    expect(await trustClassFor("vellum-principal-healed")).toBe("unknown");
+  });
+
+  test("dev-bypass maps the gateway guardian principal to guardian", async () => {
+    expect(await trustClassFor("dev-bypass")).toBe("guardian");
+  });
+
+  test("dev-bypass fails closed to unknown on an empty gateway", async () => {
+    // No active gateway binding: dev-bypass cannot translate to a real guardian,
+    // and the helper (null) leaves trust unknown — parity with /v1/surface-actions.
+    mockGuardians = [];
+    mockReResolve = null;
+    expect(await trustClassFor("dev-bypass")).toBe("unknown");
+  });
+
+  test("preserves the request body channel on the guardian-match happy path", async () => {
+    const ctx = await trustContextFor("test-user", "telegram");
+    expect(ctx.trustClass).toBe("guardian");
+    expect(ctx.sourceChannel).toBe("telegram");
+  });
+});

package/src/__tests__/inbound-slack-persistence.test.ts

@@ -35,6 +35,8 @@ const addMessageCalls: Array<{
 }> = [];
 
 mock.module("../memory/conversation-crud.js", () => ({
+    setConversationProcessingStartedAt: () => {},
+    isConversationProcessing: () => false,
   addMessage: async (
     conversationId: string,
     role: string,

package/src/__tests__/invite-redemption-service.test.ts

@@ -40,6 +40,8 @@ function resetGatewayIpc() {
   gatewayIpc.calls = [];
 }
 
+import type { TrustVerdict } from "@vellumai/gateway-client";
+
 import {
   findContactChannel,
   getContact,
@@ -56,6 +58,7 @@ import {
   type InviteRedemptionOutcome,
   redeemInvite,
   redeemInviteByCode,
+  resolveMemberGateStatus,
 } from "../runtime/invite-redemption-service.js";
 import { hashVoiceCode } from "../util/voice-code.js";
 
@@ -763,3 +766,43 @@ describe("invite-redemption-service", () => {
     ).toBeNull();
   });
 });
+
+describe("resolveMemberGateStatus", () => {
+  const memberlessVerdict: TrustVerdict = {
+    trustClass: "unverified_contact",
+    canonicalSenderId: "telegram:blocked-user",
+  };
+  const memberVerdict: TrustVerdict = {
+    trustClass: "trusted_contact",
+    canonicalSenderId: "telegram:active-user",
+    contactId: "contact-1",
+    channelId: "channel-1",
+    type: "telegram",
+    address: "active-user",
+    status: "active",
+    policy: "allow",
+  };
+
+  test("uses the verdict member status when the verdict resolves a member", async () => {
+    expect(await resolveMemberGateStatus(memberVerdict, "blocked")).toBe(
+      "active",
+    );
+  });
+
+  test("falls back to local status when a non-null verdict carries no member", async () => {
+    // A previously blocked contact with a valid invite must stay blocked even
+    // when the verdict is non-null but memberless (externalChatId-only match /
+    // resolutionFailed), so it can't bypass the gate.
+    expect(await resolveMemberGateStatus(memberlessVerdict, "blocked")).toBe(
+      "blocked",
+    );
+  });
+
+  test("falls back to local status when the verdict is null", async () => {
+    expect(await resolveMemberGateStatus(null, "blocked")).toBe("blocked");
+  });
+
+  test("returns null when neither verdict member nor local status is present", async () => {
+    expect(await resolveMemberGateStatus(memberlessVerdict, null)).toBeNull();
+  });
+});

package/src/__tests__/llm-context-normalization.test.ts

@@ -1827,4 +1827,109 @@ describe("normalizeLlmContextPayloads", () => {
       },
     ]);
   });
+
+  describe("provider error response payloads", () => {
+    test("extracts a structured error from a rejected call's response payload", () => {
+      const normalized = normalizeLlmContextPayloads({
+        createdAt: 1_742_400_000_000,
+        requestPayload: {
+          model: "accounts/fireworks/models/glm-5p2",
+          messages: [{ role: "user", content: "hello" }],
+        },
+        responsePayload: {
+          error: {
+            name: "ProviderError",
+            message:
+              "This model doesn't support image input. Remove the image or switch to a vision-capable model.",
+            code: "PROVIDER_ERROR",
+            provider: "fireworks",
+            statusCode: 400,
+          },
+        },
+      });
+
+      expect(normalized.error).toEqual({
+        name: "ProviderError",
+        message:
+          "This model doesn't support image input. Remove the image or switch to a vision-capable model.",
+        code: "PROVIDER_ERROR",
+        provider: "fireworks",
+        statusCode: 400,
+      });
+      // No response sections are produced for an error payload.
+      expect(normalized.responseSections).toBeUndefined();
+    });
+
+    test("preserves a normalized request alongside the error", () => {
+      const normalized = normalizeLlmContextPayloads({
+        createdAt: 1_742_400_000_000,
+        requestPayload: {
+          model: "gpt-4.1",
+          tool_choice: "auto",
+          messages: [{ role: "user", content: "hi" }],
+        },
+        responsePayload: { error: { message: "boom" } },
+      });
+
+      expect(normalized.error).toEqual({ message: "boom" });
+      // The request side still normalizes so the Prompt tab keeps working.
+      expect(normalized.requestSections?.length).toBeGreaterThan(0);
+      expect(normalized.summary?.provider).toBe("openai");
+    });
+
+    test("carries statusCode 0 and retryAfterMs through", () => {
+      const normalized = normalizeLlmContextPayloads({
+        createdAt: 1_742_400_000_000,
+        requestPayload: null,
+        responsePayload: {
+          error: {
+            name: "ProviderError",
+            message: "rate limited",
+            provider: "anthropic",
+            statusCode: 0,
+            retryAfterMs: 1500,
+          },
+        },
+      });
+
+      expect(normalized.error).toEqual({
+        name: "ProviderError",
+        message: "rate limited",
+        provider: "anthropic",
+        statusCode: 0,
+        retryAfterMs: 1500,
+      });
+    });
+
+    test("does not treat a successful response with no error as failed", () => {
+      const normalized = normalizeLlmContextPayloads({
+        createdAt: 1_742_400_000_000,
+        requestPayload: {
+          model: "gpt-4.1",
+          messages: [{ role: "user", content: "hi" }],
+        },
+        responsePayload: {
+          model: "gpt-4.1",
+          choices: [
+            {
+              finish_reason: "stop",
+              message: { role: "assistant", content: "hello" },
+            },
+          ],
+        },
+      });
+
+      expect(normalized.error).toBeUndefined();
+    });
+
+    test("ignores an empty error object with no identifying fields", () => {
+      const normalized = normalizeLlmContextPayloads({
+        createdAt: 1_742_400_000_000,
+        requestPayload: null,
+        responsePayload: { error: {} },
+      });
+
+      expect(normalized.error).toBeUndefined();
+    });
+  });
 });