@vellumai/assistant 0.10.12 → 0.11.0-staging.2

package/src/__tests__/events-tail-route.test.ts

@@ -13,7 +13,7 @@
  */
 import { beforeEach, describe, expect, test } from "bun:test";
 
-import type { AssistantEvent } from "../runtime/assistant-event.js";
+import type { AssistantEventEnvelope } from "../api/index.js";
 import {
   _resetStreamStateForTesting,
   stampAndBuffer,
@@ -30,7 +30,7 @@ if (!tailRoute) {
 }
 
 interface TailResponse {
-  events: AssistantEvent[];
+  events: AssistantEventEnvelope[];
   complete: boolean;
   frontier: number | null;
 }
@@ -45,7 +45,9 @@ function callTail(
   }) as TailResponse;
 }
 
-function mkEvent(overrides: Partial<AssistantEvent> = {}): AssistantEvent {
+function mkEvent(
+  overrides: Partial<AssistantEventEnvelope> = {},
+): AssistantEventEnvelope {
   const conversationId =
     "conversationId" in overrides ? overrides.conversationId : CONV;
   return {
@@ -58,7 +60,7 @@ function mkEvent(overrides: Partial<AssistantEvent> = {}): AssistantEvent {
       text: "x",
     },
     ...overrides,
-  } as AssistantEvent;
+  } as AssistantEventEnvelope;
 }
 
 describe("GET events/tail", () => {

package/src/__tests__/feature-flag-test-helpers.ts

@@ -7,29 +7,19 @@
  *
  * No source-module imports
  * ------------------------
- * This file has ZERO imports from `src/`. It accesses the feature flag
+ * This file has ZERO runtime imports from `src/`. It accesses the feature flag
  * cache's state via the shared `globalThis.vellumAssistant.featureFlagCache`
- * slot that `src/config/feature-flag-cache.ts` also reads/writes. The slot
- * shape is duplicated here on purpose: keeping this file off the
- * production import graph is what protects the test preload from a
- * broken `node_modules` symlink (DB ghost #3). The two declarations MUST
- * stay in sync — if you change one, change the other.
+ * slot that `src/config/feature-flag-cache.ts` also reads/writes, typed by the
+ * shared ambient `VellumFeatureFlagCache` (declared in
+ * `src/vellum-assistant-namespace.d.ts`). That ambient type is pure
+ * compile-time information — referencing it adds nothing to this file's runtime
+ * import graph — so keeping the helper off the production import graph (what
+ * protects the test preload from a broken `node_modules` symlink, DB ghost #3)
+ * still holds.
  */
 
-// Mirrors `src/config/feature-flag-cache.ts`. Duplicated by design — see
-// the "No source-module imports" section above.
-type FlagSlot = {
-  overrides: Record<string, boolean | string> | null;
-  fromGateway: boolean;
-};
-
-type VellumAssistantNamespace = {
-  featureFlagCache?: FlagSlot;
-};
-
-function flagSlot(): FlagSlot {
-  const g = globalThis as { vellumAssistant?: VellumAssistantNamespace };
-  const ns = (g.vellumAssistant ??= {});
+function flagSlot(): VellumFeatureFlagCache {
+  const ns = (globalThis.vellumAssistant ??= {});
   return (ns.featureFlagCache ??= { overrides: null, fromGateway: false });
 }
 

package/src/__tests__/file-edit-tool.test.ts

@@ -128,15 +128,35 @@ describe("file_edit tool (sandbox)", () => {
     expect(result.content).toContain("old_string not found");
   });
 
-  test("blocks path traversal escape", async () => {
+  test("edits a file outside the workspace boundary (non-containerized)", async () => {
     const dir = makeTempDir();
+    const outside = makeTempDir();
+    const target = join(outside, "escape.txt");
+    writeFileSync(target, "hello world\n");
 
     const result = await fileEditTool.execute(
-      { path: "../../../etc/hosts", old_string: "a", new_string: "b" },
+      { path: target, old_string: "hello world", new_string: "updated" },
       makeContext(dir),
     );
 
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain("outside the working directory");
+    expect(result.isError).toBe(false);
+    expect(readFileSync(target, "utf-8")).toBe("updated\n");
+  });
+
+  test("blocks path traversal escape when containerized", async () => {
+    const dir = makeTempDir();
+    process.env.IS_CONTAINERIZED = "true";
+    try {
+      const result = await fileEditTool.execute(
+        { path: "../../../etc/hosts", old_string: "a", new_string: "b" },
+        makeContext(dir),
+      );
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain("outside the working directory");
+      expect(result.content).toContain("host_file_edit");
+    } finally {
+      delete process.env.IS_CONTAINERIZED;
+    }
   });
 });

package/src/__tests__/file-list-tool.test.ts

@@ -172,7 +172,8 @@ describe("FileListTool", () => {
       makeToolContext(dir),
     );
     expect(result.isError).toBe(true);
-    expect(result.content).toContain("path is required and must be a string");
+    expect(result.content).toContain('Invalid input for tool "file_list"');
+    expect(result.content).toContain("path:");
   });
 
   test("execute() returns error for nonexistent directory", async () => {

package/src/__tests__/file-read-tool.test.ts

@@ -7,7 +7,14 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterEach, beforeAll, describe, expect, test } from "bun:test";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from "bun:test";
 
 import { finalizeTool } from "../tools/tool-defaults.js";
 import type { Tool, ToolContext } from "../tools/types.js";
@@ -81,15 +88,34 @@ describe("file_read tool (sandbox)", () => {
     expect(result.content).toContain("is a directory");
   });
 
-  test("rejects path traversal outside working dir", async () => {
+  test("reads a file outside the workspace boundary (non-containerized)", async () => {
     const dir = makeTempDir();
+    const outside = makeTempDir();
+    const target = join(outside, "escape.txt");
+    writeFileSync(target, "outside content");
 
     const result = await fileReadTool.execute(
-      { path: "../../../etc/passwd" },
+      { path: target },
       makeContext(dir),
     );
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain("outside the working directory");
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("outside content");
+  });
+
+  test("rejects path traversal outside working dir when containerized", async () => {
+    const dir = makeTempDir();
+    process.env.IS_CONTAINERIZED = "true";
+    try {
+      const result = await fileReadTool.execute(
+        { path: "../../../etc/passwd" },
+        makeContext(dir),
+      );
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain("outside the working directory");
+    } finally {
+      delete process.env.IS_CONTAINERIZED;
+    }
   });
 });
 
@@ -166,22 +192,48 @@ describe("file_read image support", () => {
     expect(result.content).toContain("file not found");
   });
 
-  test("blocks image path traversal outside working dir", async () => {
+  test("reads an image outside the workspace boundary (non-containerized)", async () => {
     const dir = makeTempDir();
+    const outside = makeTempDir();
+    writeFileSync(join(outside, "photo.jpg"), JPEG_HEADER);
 
     const result = await fileReadTool.execute(
-      { path: "../../etc/secret.png" },
+      { path: join(outside, "photo.jpg") },
       makeContext(dir),
     );
 
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain("outside the working directory");
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Image loaded");
+  });
+
+  test("blocks image path traversal outside working dir when containerized", async () => {
+    const dir = makeTempDir();
+    process.env.IS_CONTAINERIZED = "true";
+    try {
+      const result = await fileReadTool.execute(
+        { path: "../../etc/secret.png" },
+        makeContext(dir),
+      );
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain("outside the working directory");
+    } finally {
+      delete process.env.IS_CONTAINERIZED;
+    }
   });
 });
 
-// ── Out-of-bounds hint for host_file_read ─────────────────────────────
+// ── Out-of-bounds hint for host_file_read (containerized) ─────────────
 
 describe("file_read out-of-bounds hint", () => {
+  beforeEach(() => {
+    process.env.IS_CONTAINERIZED = "true";
+  });
+
+  afterEach(() => {
+    delete process.env.IS_CONTAINERIZED;
+  });
+
   test("suggests host_file_read for out-of-bounds text file path", async () => {
     const dir = makeTempDir();
 

package/src/__tests__/file-write-tool.test.ts

@@ -27,7 +27,7 @@ const enqueueCalls: Array<{
 }> = [];
 let enqueueThrows = false;
 
-mock.module("../plugins/defaults/memory/jobs/embed-pkb-file.js", () => ({
+mock.module("../plugins/defaults/memory/v1/jobs/embed-pkb-file.js", () => ({
   enqueuePkbIndexJob: (input: { pkbRoot: string; absPath: string }) => {
     if (enqueueThrows) {
       throw new Error("simulated enqueue failure");
@@ -144,16 +144,35 @@ describe("file_write tool (sandbox)", () => {
     expect(readFileSync(filePath, "utf-8")).toBe("deep content");
   });
 
-  test("blocks path traversal escape", async () => {
+  test("writes outside the workspace boundary (non-containerized)", async () => {
     const dir = makeTempDir();
+    const outside = makeTempDir();
+    const target = join(outside, "escape.txt");
 
     const result = await fileWriteTool.execute(
-      { path: "../../escape.txt", content: "escaped" },
+      { path: target, content: "escaped" },
       makeContext(dir),
     );
 
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain("outside the working directory");
+    expect(result.isError).toBe(false);
+    expect(readFileSync(target, "utf-8")).toBe("escaped");
+  });
+
+  test("blocks path traversal escape when containerized", async () => {
+    const dir = makeTempDir();
+    process.env.IS_CONTAINERIZED = "true";
+    try {
+      const result = await fileWriteTool.execute(
+        { path: "../../escape.txt", content: "escaped" },
+        makeContext(dir),
+      );
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain("outside the working directory");
+      expect(result.content).toContain("host_file_write");
+    } finally {
+      delete process.env.IS_CONTAINERIZED;
+    }
   });
 
   test("blocks oversize content", async () => {

package/src/__tests__/followup-tools.test.ts

@@ -308,3 +308,61 @@ describe("followup_resolve tool", () => {
     );
   });
 });
+
+// ── model-input schema validation (LUM-2856) ────────────────────────
+
+describe("followup tools — model-input schema validation", () => {
+  test("followup_create rejects a non-string contact_id", async () => {
+    const result = await executeFollowupCreate(
+      { channel: "email", conversation_id: "conv-1", contact_id: 42 },
+      ctx,
+    );
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain(
+      'Invalid input for tool "followup_create"',
+    );
+    expect(result.content).toContain("contact_id");
+  });
+
+  test("followup_create keeps the bespoke positive-number error for expected_response_hours", async () => {
+    const result = await executeFollowupCreate(
+      {
+        channel: "email",
+        conversation_id: "conv-1",
+        expected_response_hours: "soon",
+      },
+      ctx,
+    );
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain(
+      "expected_response_hours must be a positive number",
+    );
+  });
+
+  test("followup_create treats explicit null channel as missing (bespoke error)", async () => {
+    const result = await executeFollowupCreate(
+      { channel: null, conversation_id: "conv-1" },
+      ctx,
+    );
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("channel is required");
+  });
+
+  test("followup_list rejects a non-boolean overdue_only but keeps the bespoke status error", async () => {
+    const bad = await executeFollowupList({ overdue_only: "yes" }, ctx);
+    expect(bad.isError).toBe(true);
+    expect(bad.content).toContain('Invalid input for tool "followup_list"');
+
+    const status = await executeFollowupList({ status: 42 }, ctx);
+    expect(status.isError).toBe(true);
+    expect(status.content).toContain("Invalid status");
+  });
+
+  test("followup_resolve rejects a non-string id", async () => {
+    const result = await executeFollowupResolve({ id: 42 }, ctx);
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain(
+      'Invalid input for tool "followup_resolve"',
+    );
+  });
+});

package/src/__tests__/gateway-threshold-reader-mock.ts

@@ -0,0 +1,99 @@
+/**
+ * Shared module mock for `permissions/gateway-threshold-reader`.
+ *
+ * `mock.module` registrations are process-global and last-one-wins, so files
+ * that each stubbed this module their own way overwrote each other depending
+ * on load order — a file could pass alone and fail in a batch (or worse, pass
+ * for the wrong reason) because a sibling's stub was the one actually live.
+ *
+ * Every file registers this same delegating mock instead and steers it by
+ * writing to {@link thresholdReaderMock}. Which registration wins no longer
+ * changes behaviour, so the stubs a test sets are the stubs it gets.
+ *
+ * Holds no production imports — only mutable state the mock reads — so it is
+ * safe to load from preload-time test machinery.
+ */
+import { mock } from "bun:test";
+
+/** What the mocked cell lookup resolves to. `ok: false` is a transport failure. */
+export type MockCellResult =
+  | { ok: true; resolved: { threshold: string; scope: string } | null }
+  | { ok: false };
+
+export interface ThresholdReaderMockState {
+  /** Resolved by `getAutoApproveThreshold`. */
+  threshold: string | undefined;
+  /** Resolved by `refreshAutoApproveThreshold`; `null` means "refresh failed". */
+  refreshed: string | null;
+  /** Resolved by `resolveChannelPermissionCell`. */
+  cell: MockCellResult;
+  /** The collapsed-global room default `channelNoCellDefault` derives. */
+  roomDefault: string | undefined;
+  /** Every `getAutoApproveThreshold` call, in order. */
+  thresholdReads: Array<{
+    conversationId?: string;
+    executionContext?: string;
+    cellQuery?: Record<string, unknown>;
+  }>;
+  /** How many times the cell was looked up. */
+  cellLookups: number;
+}
+
+export const thresholdReaderMock: ThresholdReaderMockState = {
+  threshold: undefined,
+  refreshed: null,
+  cell: { ok: true, resolved: null },
+  roomDefault: "low",
+  thresholdReads: [],
+  cellLookups: 0,
+};
+
+/**
+ * Restore the defaults: no cell anywhere, a Conservative room default,
+ * failed refresh, no recorded calls.
+ */
+export function resetThresholdReaderMock(): void {
+  thresholdReaderMock.threshold = undefined;
+  thresholdReaderMock.refreshed = null;
+  thresholdReaderMock.cell = { ok: true, resolved: null };
+  thresholdReaderMock.roomDefault = "low";
+  thresholdReaderMock.thresholdReads.length = 0;
+  thresholdReaderMock.cellLookups = 0;
+}
+
+/**
+ * Register the mock. Call at module scope, before importing the code under
+ * test. Safe to call from several files in one run — each registration
+ * installs the same delegating stubs.
+ */
+export function installThresholdReaderMock(): void {
+  mock.module("../permissions/gateway-threshold-reader.js", () => ({
+    getAutoApproveThreshold: async (
+      conversationId?: string,
+      executionContext?: string,
+      cellQuery?: Record<string, unknown>,
+    ) => {
+      thresholdReaderMock.thresholdReads.push({
+        conversationId,
+        executionContext,
+        cellQuery,
+      });
+      return thresholdReaderMock.threshold;
+    },
+    refreshAutoApproveThreshold: async () => thresholdReaderMock.refreshed,
+    resolveChannelPermissionCell: async () => {
+      thresholdReaderMock.cellLookups += 1;
+      return thresholdReaderMock.cell;
+    },
+    // Mirrors the production guard: only a successful no-cell walk for a
+    // non-guardian derives the default. Reimplemented here (three lines)
+    // because this file must hold no production imports.
+    channelNoCellDefault: async (cell: MockCellResult, contactType: string) => {
+      if (!cell.ok || cell.resolved || contactType === "guardian") {
+        return undefined;
+      }
+      return thresholdReaderMock.roomDefault;
+    },
+    _clearGlobalCacheForTesting: () => {},
+  }));
+}

package/src/__tests__/graph-extraction-event-date.test.ts

@@ -5,7 +5,7 @@ import {
   EVENT_DATE_PROMPT_RULES,
   parseEpochMs,
   parseExtractionResponse,
-} from "../plugins/defaults/memory/graph/extraction.js";
+} from "../plugins/defaults/memory/v1/graph/extraction.js";
 
 // ---------------------------------------------------------------------------
 // parseEpochMs unit tests

package/src/__tests__/guardian-question-mode.test.ts

@@ -67,12 +67,29 @@ describe("guardian-question-mode", () => {
     expect(parsed.toolName).toBe("send_email");
   });
 
-  test("rejects invalid pending_question payload missing required fields", () => {
+  test("accepts a pending_question payload without voice fields (ask_question shape)", () => {
+    // callSessionId/activeGuardianRequestCount are voice-variant fields; an
+    // ask_question promotion carries neither (and may carry options instead).
     const parsed = parseGuardianQuestionPayload({
       requestKind: "pending_question",
       requestId: "req-3",
       requestCode: "AAA111",
-      questionText: "Missing call session and count",
+      questionText: "Which fruit?",
+      options: [
+        { id: "apple", label: "Apple" },
+        { id: "banana", label: "Banana" },
+      ],
+    });
+    expect(parsed).not.toBeNull();
+    if (!parsed || parsed.requestKind !== "pending_question") return;
+    expect(parsed.options?.map((o) => o.id)).toEqual(["apple", "banana"]);
+  });
+
+  test("rejects a pending_question payload missing base fields", () => {
+    const parsed = parseGuardianQuestionPayload({
+      requestKind: "pending_question",
+      requestId: "req-3",
+      // no requestCode / questionText — base-field strictness still holds
     });
     expect(parsed).toBeNull();
   });
@@ -274,7 +291,21 @@ describe("guardian-question-mode", () => {
       }),
     ).toBeNull();
 
-    // Strict-parse failure: missing required pending_question fields.
+    // Answer mode without voice fields (ask_question shape): still no
+    // Approve/Reject buttons — its options render via the broadcaster's
+    // question-options context instead.
+    expect(
+      parseInteractiveApprovalPayload({
+        requestKind: "pending_question",
+        requestId: "req-2b",
+        requestCode: "A1B2C3",
+        questionText: "Which fruit?",
+      }),
+    ).toBeNull();
+
+    // A pending_question carrying a toolName resolves to approval mode (a
+    // guardian approval asked as a question), so it DOES render the pair —
+    // mode, not voice-field presence, decides the rendering.
     expect(
       parseInteractiveApprovalPayload({
         requestKind: "pending_question",
@@ -283,6 +314,14 @@ describe("guardian-question-mode", () => {
         questionText: "Allow send_email?",
         toolName: "send_email",
       }),
+    ).not.toBeNull();
+
+    // Strict-parse failure: missing base fields.
+    expect(
+      parseInteractiveApprovalPayload({
+        requestKind: "pending_question",
+        requestId: "req-4",
+      }),
     ).toBeNull();
   });
 });