@vellumai/assistant 0.10.12 → 0.11.0-staging.1

package/src/__tests__/outbound-slack-persistence.test.ts

@@ -66,7 +66,7 @@ mock.module("../persistence/conversation-crud.js", () => ({
     updates: Record<string, unknown>,
   ) => {
     const row = persistedRows.find((candidate) => candidate.id === messageId);
-    if (!row) return;
+    if (!row) {return;}
     const existing =
       row.metadata && typeof row.metadata === "string"
         ? (JSON.parse(row.metadata) as Record<string, unknown>)
@@ -78,18 +78,18 @@ mock.module("../persistence/conversation-crud.js", () => ({
     // `lastAssistantPersisted()` assertions continue to find the row that
     // was reserved at `llm_call_started` time.
     const row = persistedRows.find((candidate) => candidate.id === messageId);
-    if (row) row.content = content;
+    if (row) {row.content = content;}
     const call = addMessageCalls.find((c) => c.id === messageId);
-    if (call) call.content = content;
+    if (call) {call.content = content;}
   },
   markMessageContentInflight: () => {},
   finalizeMessageContent: (messageId: string, content: string) => {
     // The finalize seam writes through `finalizeMessageContent`; mirror it
     // into the same captures as `updateMessageContent`.
     const row = persistedRows.find((candidate) => candidate.id === messageId);
-    if (row) row.content = content;
+    if (row) {row.content = content;}
     const call = addMessageCalls.find((c) => c.id === messageId);
-    if (call) call.content = content;
+    if (call) {call.content = content;}
   },
   // The handler treats provenance as a flat spread; returning {} keeps the
   // metadata snapshot focused on the fields under test.
@@ -153,6 +153,7 @@ mock.module("../persistence/attachments-store.js", () => ({
 // ── Imports (after mocks) ──────────────────────────────────────────────────
 
 import type { AgentEvent } from "../agent/loop.js";
+import type { AssistantEvent } from "../api/index.js";
 import type {
   EventHandlerDeps,
   EventHandlerState,
@@ -162,7 +163,6 @@ import {
   handleLlmCallStarted,
   handleMessageComplete,
 } from "../daemon/conversation-agent-loop-handlers.js";
-import type { ServerMessage } from "../daemon/message-protocol.js";
 import { readSlackMetadata } from "../messaging/providers/slack/message-metadata.js";
 import { deliverReplyViaCallback } from "../runtime/channel-reply-delivery.js";
 import { setConfig } from "./helpers/set-config.js";
@@ -194,7 +194,7 @@ function makeDeps(
       },
       clientTimezone: overrides.clientTimezone,
     } as unknown as EventHandlerDeps["ctx"],
-    onEvent: (_msg: ServerMessage) => {},
+    onEvent: (_msg: AssistantEvent) => {},
     reqId: "test-req-id",
     isFirstMessage: false,
     shouldGenerateTitle: false,
@@ -233,7 +233,7 @@ function makeMessageCompleteEvent(
 /** Find the most recently persisted assistant-role message in the capture log. */
 function lastAssistantPersisted(): AddMessageCall {
   for (let i = addMessageCalls.length - 1; i >= 0; i--) {
-    if (addMessageCalls[i].role === "assistant") return addMessageCalls[i];
+    if (addMessageCalls[i].role === "assistant") {return addMessageCalls[i];}
   }
   throw new Error("No assistant message was persisted via addMessage");
 }

package/src/__tests__/path-policy.test.ts

@@ -14,7 +14,9 @@ import {
   hostPolicy,
   resolveRealPath,
   sandboxPolicy,
+  sandboxPolicyWithHostFallback,
 } from "../tools/shared/filesystem/path-policy.js";
+import { getDotEnvPath } from "../util/platform.js";
 
 // ── Mock setup for skill path classifier ────────────────────────────────────
 // The classifier imports getWorkspaceSkillsDir and getBundledSkillsDir, which
@@ -94,6 +96,30 @@ describe("sandboxPolicy", () => {
     }
   });
 
+  test("resolveRealPath follows a trailing dangling symlink to its destination", () => {
+    const dir = makeTempDir();
+    const outside = makeTempDir();
+    const destination = join(outside, "not-yet.txt");
+    symlinkSync(destination, join(dir, "dangle"));
+
+    expect(resolveRealPath(join(dir, "dangle"))).toBe(destination);
+  });
+
+  test("rejects a dangling symlink whose destination escapes the boundary", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+
+    // A dangling link inside the boundary pointing at a nonexistent outside
+    // file: a write through it would create the outside destination.
+    symlinkSync(join(outside, "not-yet.txt"), join(boundary, "dangle"));
+
+    const result = sandboxPolicy("dangle", boundary, { mustExist: false });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("out_of_bounds");
+    }
+  });
+
   test("rejects parent dir symlink escape in mustExist=false flow", () => {
     const boundary = makeTempDir();
     const outside = makeTempDir();
@@ -191,6 +217,295 @@ describe("sandboxPolicy", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Sandbox policy with host fallback
+// ---------------------------------------------------------------------------
+
+describe("sandboxPolicyWithHostFallback", () => {
+  afterEach(() => {
+    delete process.env.IS_CONTAINERIZED;
+    delete process.env.GATEWAY_SECURITY_DIR;
+    delete process.env.CREDENTIAL_SECURITY_DIR;
+  });
+
+  test("matches sandboxPolicy for in-bounds paths", () => {
+    const boundary = makeTempDir();
+    mkdirSync(join(boundary, "sub"));
+
+    const result = sandboxPolicyWithHostFallback("sub/file.txt", boundary);
+    expect(result).toEqual(sandboxPolicy("sub/file.txt", boundary));
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.resolved).toBe(join(boundary, "sub", "file.txt"));
+    }
+  });
+
+  test("allows an absolute path outside the boundary", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+    const target = join(outside, "file.txt");
+    writeFileSync(target, "x");
+
+    const result = sandboxPolicyWithHostFallback(target, boundary);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.resolved).toBe(target);
+    }
+  });
+
+  test("allows a relative traversal escape", () => {
+    const boundary = makeTempDir();
+
+    const result = sandboxPolicyWithHostFallback("../escape.txt", boundary, {
+      mustExist: false,
+    });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.resolved).toBe(join(boundary, "..", "escape.txt"));
+    }
+  });
+
+  test("allows a symlink that escapes the boundary", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+    symlinkSync(outside, join(boundary, "escape-link"));
+
+    const result = sandboxPolicyWithHostFallback("escape-link", boundary);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.resolved).toBe(join(boundary, "escape-link"));
+    }
+  });
+
+  test("denies out-of-bounds denylisted basenames", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+
+    const result = sandboxPolicyWithHostFallback(
+      join(outside, "backup.key"),
+      boundary,
+      { mustExist: false },
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("denies paths inside the gateway security dir (env override)", () => {
+    const boundary = makeTempDir();
+    const securityDir = makeTempDir();
+    process.env.GATEWAY_SECURITY_DIR = securityDir;
+
+    const result = sandboxPolicyWithHostFallback(
+      join(securityDir, "trust.json"),
+      boundary,
+      { mustExist: false },
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+      expect(result.error).toContain("service security directory");
+    }
+  });
+
+  test("denies paths inside the CES security dir (env override)", () => {
+    const boundary = makeTempDir();
+    const securityDir = makeTempDir();
+    process.env.CREDENTIAL_SECURITY_DIR = securityDir;
+
+    for (const basename of ["keys.enc", "store.key"]) {
+      const result = sandboxPolicyWithHostFallback(
+        join(securityDir, basename),
+        boundary,
+        { mustExist: false },
+      );
+      expect(result.ok).toBe(false);
+      if (!result.ok) {
+        expect(result.reason).toBe("denied");
+      }
+    }
+  });
+
+  test("a root-configured security dir denies every absolute target", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+    process.env.GATEWAY_SECURITY_DIR = "/";
+
+    const result = sandboxPolicyWithHostFallback(
+      join(outside, "trust.json"),
+      boundary,
+      { mustExist: false },
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("denies the daemon dotenv", () => {
+    const boundary = makeTempDir();
+
+    const result = sandboxPolicyWithHostFallback(getDotEnvPath(), boundary, {
+      mustExist: false,
+    });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("denies the default gateway security dir when the env is unset", () => {
+    const boundary = makeTempDir();
+
+    const result = sandboxPolicyWithHostFallback(
+      join(
+        process.env.HOME!,
+        ".vellum",
+        "protected",
+        "actor-token-signing-key",
+      ),
+      boundary,
+      { mustExist: false },
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("denies the gateway security dir even when it sits inside the boundary", () => {
+    const boundary = makeTempDir();
+    const securityDir = join(boundary, "protected");
+    mkdirSync(securityDir);
+    process.env.GATEWAY_SECURITY_DIR = securityDir;
+
+    for (const policy of [sandboxPolicy, sandboxPolicyWithHostFallback]) {
+      const result = policy("protected/trust.json", boundary, {
+        mustExist: false,
+      });
+      expect(result.ok).toBe(false);
+      if (!result.ok) {
+        expect(result.reason).toBe("denied");
+      }
+    }
+  });
+
+  test("denies a dangling symlink pointing into the gateway security dir", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+    const securityDir = makeTempDir();
+    process.env.GATEWAY_SECURITY_DIR = securityDir;
+    // The destination does NOT exist — a write through the link would create
+    // it inside the security dir.
+    symlinkSync(
+      join(securityDir, "new-signing-key"),
+      join(outside, "innocent.txt"),
+    );
+
+    const result = sandboxPolicyWithHostFallback(
+      join(outside, "innocent.txt"),
+      boundary,
+      { mustExist: false },
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("denies a long dangling symlink chain into the gateway security dir", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+    const securityDir = makeTempDir();
+    process.env.GATEWAY_SECURITY_DIR = securityDir;
+
+    // A 33-link chain exceeds macOS's own 32-link traversal limit but stays
+    // within Linux's 40 — the policy must resolve past it either way.
+    let target = join(securityDir, "new-signing-key");
+    for (let i = 32; i >= 0; i--) {
+      const link = join(outside, `link-${i}`);
+      symlinkSync(target, link);
+      target = link;
+    }
+
+    const result = sandboxPolicyWithHostFallback(target, boundary, {
+      mustExist: false,
+    });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("denies a symlink that resolves into the gateway security dir", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+    const securityDir = makeTempDir();
+    process.env.GATEWAY_SECURITY_DIR = securityDir;
+    writeFileSync(join(securityDir, "trust.json"), "{}");
+    symlinkSync(
+      join(securityDir, "trust.json"),
+      join(outside, "innocent.json"),
+    );
+
+    const result = sandboxPolicyWithHostFallback(
+      join(outside, "innocent.json"),
+      boundary,
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("fails closed to the hard boundary when a security-dir override is relative", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+    // A relative override resolves against the owning service's cwd, which
+    // the daemon cannot know — the deny set is unmirrorable, so no escape
+    // is permitted at all.
+    process.env.GATEWAY_SECURITY_DIR = "relative/security-dir";
+
+    const result = sandboxPolicyWithHostFallback(
+      join(outside, "file.txt"),
+      boundary,
+      { mustExist: false },
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("out_of_bounds");
+    }
+  });
+
+  test("keeps the hard boundary when containerized", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+    process.env.IS_CONTAINERIZED = "true";
+
+    const result = sandboxPolicyWithHostFallback(
+      join(outside, "file.txt"),
+      boundary,
+      { mustExist: false },
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("out_of_bounds");
+      expect(result.error).toContain("outside the working directory");
+    }
+  });
+
+  test("still accepts in-bounds paths when containerized", () => {
+    const boundary = makeTempDir();
+    process.env.IS_CONTAINERIZED = "true";
+
+    const result = sandboxPolicyWithHostFallback("file.txt", boundary, {
+      mustExist: false,
+    });
+    expect(result.ok).toBe(true);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Host policy
 // ---------------------------------------------------------------------------

package/src/__tests__/pending-interactions-resolved-event.test.ts

@@ -10,14 +10,14 @@
 
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
-import type { ServerMessage } from "../daemon/message-protocol.js";
+import type { AssistantEvent } from "../api/index.js";
 
 // Capture every broadcast emitted by the tracker. The real hub is replaced
 // with a thin recorder so we can assert payloads deterministically.
-const publishedMessages: ServerMessage[] = [];
+const publishedMessages: AssistantEvent[] = [];
 
 mock.module("../runtime/assistant-event-hub.js", () => ({
-  broadcastMessage: (msg: ServerMessage) => {
+  broadcastMessage: (msg: AssistantEvent) => {
     publishedMessages.push(msg);
   },
   capabilityForMessageType: () => undefined,
@@ -41,7 +41,7 @@ afterEach(() => {
 function lastResolvedEvent() {
   const evt = publishedMessages.find((m) => m.type === "interaction_resolved");
   expect(evt).toBeDefined();
-  return evt as Extract<ServerMessage, { type: "interaction_resolved" }>;
+  return evt as Extract<AssistantEvent, { type: "interaction_resolved" }>;
 }
 
 describe("pendingInteractions.resolve emits interaction_resolved", () => {
@@ -181,7 +181,7 @@ describe("removeByConversation emits interaction_resolved per entry", () => {
 
     const events = publishedMessages.filter(
       (m) => m.type === "interaction_resolved",
-    ) as Extract<ServerMessage, { type: "interaction_resolved" }>[];
+    ) as Extract<AssistantEvent, { type: "interaction_resolved" }>[];
     expect(events).toHaveLength(2);
     expect(events.every((e) => e.state === "superseded")).toBe(true);
     const requestIds = new Set(events.map((e) => e.requestId));
@@ -207,7 +207,7 @@ describe("removeByConversation emits interaction_resolved per entry", () => {
     );
     expect(events).toHaveLength(1);
     expect(
-      (events[0] as Extract<ServerMessage, { type: "interaction_resolved" }>)
+      (events[0] as Extract<AssistantEvent, { type: "interaction_resolved" }>)
         .state,
     ).toBe("cancelled");
   });

package/src/__tests__/persistence-layering-guard.test.ts

@@ -65,7 +65,7 @@ const PERSISTENCE_TO_MEMORY_ALLOWLIST: Record<string, ReadonlySet<string>> = {
  *
  * `steps.ts` is the ordered list of every migration step; it imports each
  * migration's forward/down function from the domain that owns it (memory's
- * `graph/bootstrap`, apps' `app-store`, …). Migrations are append-only and
+ * `v1/graph/bootstrap`, apps' `app-store`, …). Migrations are append-only and
  * checkpointed by stable function name, so they live in their owning feature by
  * design and are merely *referenced* here by the registry — this is the
  * registry's job, not a layering violation to ratchet to zero. Validated by the
@@ -73,7 +73,7 @@ const PERSISTENCE_TO_MEMORY_ALLOWLIST: Record<string, ReadonlySet<string>> = {
  * entry here.
  */
 const MIGRATION_REGISTRY_MEMORY_IMPORTS: Record<string, ReadonlySet<string>> = {
-  "assistant/src/persistence/steps.ts": new Set(["graph/bootstrap"]),
+  "assistant/src/persistence/steps.ts": new Set(["v1/graph/bootstrap"]),
 };
 
 /** Match `from "x"`, `import "x"`, `import("x")`, and `mock.module("x", …)`. */

package/src/__tests__/pkb-autoinject.test.ts

@@ -6,7 +6,7 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import {
   getPkbAutoInjectList,
   readAutoinjectList,
-} from "../plugins/defaults/memory/pkb/autoinject.js";
+} from "../plugins/defaults/memory/v1/pkb/autoinject.js";
 
 const PKB_DEFAULT_FILES = [
   "INDEX.md",

package/src/__tests__/platform-bash-auto-approve.test.ts

@@ -92,6 +92,7 @@ mock.module("../tools/registry.js", () => ({
 
 mock.module("../tools/shared/filesystem/path-policy.js", () => ({
   sandboxPolicy: () => ({ ok: false }),
+  sandboxPolicyWithHostFallback: () => ({ ok: false }),
   hostPolicy: () => ({ ok: false }),
 }));
 

package/src/__tests__/plugin-event-hub-facade.test.ts

@@ -10,13 +10,17 @@
 
 import { describe, expect, test } from "bun:test";
 
+import type { AssistantEventEnvelope } from "../api/index.js";
 import { assistantEventHub as pluginHub } from "../plugin-api/index.js";
-import type { AssistantEvent } from "../runtime/assistant-event.js";
 import { assistantEventHub as rawHub } from "../runtime/assistant-event-hub.js";
 
+// The hub's `publish` fans out locally only in the main daemon; elsewhere it
+// forwards over IPC. A test process defaults to "main daemon" (set by the test
+// preload), so these local-delivery assertions hold.
+
 /** Minimal event envelope; the facade guard keys only off `message.type`. */
-function envelope(type: string): AssistantEvent {
-  return { message: { type } } as unknown as AssistantEvent;
+function envelope(type: string): AssistantEventEnvelope {
+  return { message: { type } } as unknown as AssistantEventEnvelope;
 }
 
 function eventType(event: unknown): unknown {
@@ -24,7 +28,7 @@ function eventType(event: unknown): unknown {
 }
 
 /** Register a host-capable desktop client subscriber on the raw hub. */
-function subscribeHostClient(clientId: string, sink: AssistantEvent[]) {
+function subscribeHostClient(clientId: string, sink: AssistantEventEnvelope[]) {
   return rawHub.subscribe({
     type: "client",
     clientId,
@@ -65,11 +69,14 @@ describe("plugin-facing assistantEventHub facade", () => {
     const proto = Object.getPrototypeOf(pluginHub) as { publish?: unknown };
     expect(typeof proto?.publish).not.toBe("function");
 
-    const received: AssistantEvent[] = [];
+    const received: AssistantEventEnvelope[] = [];
     const sub = subscribeHostClient("facade-proto-client", received);
     try {
       const p = Object.getPrototypeOf(pluginHub) as {
-        publish?: (event: AssistantEvent, options?: unknown) => Promise<void>;
+        publish?: (
+          event: AssistantEventEnvelope,
+          options?: unknown,
+        ) => Promise<void>;
       } | null;
       await p?.publish?.call(pluginHub, envelope("host_bash_request"), {
         targetClientId: "facade-proto-client",
@@ -97,7 +104,7 @@ describe("plugin-facing assistantEventHub facade", () => {
   });
 
   test("snapshots the event so a mutating type getter cannot bypass the guard (Codex P1)", async () => {
-    const received: AssistantEvent[] = [];
+    const received: AssistantEventEnvelope[] = [];
     const sub = subscribeHostClient("facade-toctou-client", received);
     try {
       // `message.type` reads benign first (what the guard would see) then turns
@@ -111,7 +118,7 @@ describe("plugin-facing assistantEventHub facade", () => {
           return reads === 1 ? "sync_changed" : "host_bash_request";
         },
       });
-      const sneaky = { message } as unknown as AssistantEvent;
+      const sneaky = { message } as unknown as AssistantEventEnvelope;
 
       await pluginHub.publish(sneaky, {
         targetClientId: "facade-toctou-client",
@@ -127,7 +134,7 @@ describe("plugin-facing assistantEventHub facade", () => {
   });
 
   test("freezes the published snapshot so a subscriber cannot mutate it mid-fanout (Codex P1)", async () => {
-    const hostReceived: AssistantEvent[] = [];
+    const hostReceived: AssistantEventEnvelope[] = [];
     // A malicious subscriber registered first tries to turn the in-flight event
     // into a host request before the host-capable client (registered after)
     // receives the same fanned-out object.
@@ -154,7 +161,7 @@ describe("plugin-facing assistantEventHub facade", () => {
   });
 
   test("rejects host events disguised as boxed strings (Codex P1)", async () => {
-    const received: AssistantEvent[] = [];
+    const received: AssistantEventEnvelope[] = [];
     const sub = subscribeHostClient("facade-boxed-client", received);
     try {
       // `new String(...)` is typeof "object" (slipping a naive string guard) but
@@ -164,7 +171,7 @@ describe("plugin-facing assistantEventHub facade", () => {
       const boxedType = new String("host_bash_request");
       const boxed = {
         message: { type: boxedType },
-      } as unknown as AssistantEvent;
+      } as unknown as AssistantEventEnvelope;
       let rejected: unknown;
       try {
         await pluginHub.publish(boxed, {
@@ -183,7 +190,7 @@ describe("plugin-facing assistantEventHub facade", () => {
   });
 
   test("delegates non-host publish to the shared singleton", async () => {
-    const received: AssistantEvent[] = [];
+    const received: AssistantEventEnvelope[] = [];
     // Subscribe on the RAW hub, publish through the FACADE: delivery proves the
     // facade delegates to the same instance (shared subscriber state). The
     // delivered event is a snapshot, so it is compared by value, not identity.
@@ -214,7 +221,7 @@ describe("plugin-facing assistantEventHub facade", () => {
   });
 
   test("downgrades plugin client subscriptions to in-process (no host-event interception) (Codex P1)", async () => {
-    const received: AssistantEvent[] = [];
+    const received: AssistantEventEnvelope[] = [];
     // Ask for a host-capable client subscription; the facade must register a
     // process subscriber, which never receives capability-targeted host events.
     const sub = pluginHub.subscribe({
@@ -237,7 +244,7 @@ describe("plugin-facing assistantEventHub facade", () => {
   });
 
   test("isolates plugin callbacks so they cannot mutate the in-flight fanout event (Codex P1)", async () => {
-    const hostReceived: AssistantEvent[] = [];
+    const hostReceived: AssistantEventEnvelope[] = [];
     // The plugin subscribes first and, from its callback, tries to rewrite the
     // shared in-flight event into a host request. It must only see an isolated
     // copy, leaving the real client's event untouched.
@@ -292,7 +299,7 @@ describe("plugin-facing assistantEventHub facade", () => {
         {
           message: { type: "host_bash_request" },
           conversationId: "conv-1",
-        } as unknown as AssistantEvent,
+        } as unknown as AssistantEventEnvelope,
         { targetCapability: "host_bash" },
       );
       expect(getterCalls).toBe(callsAfterSubscribe);