@vellumai/assistant 0.10.3 → 0.10.4-staging.1

package/src/__tests__/voice-guardian-cold-cache-warm.test.ts

@@ -0,0 +1,137 @@
+/**
+ * Cold-cache guardian voice/phone regression.
+ *
+ * The sync trust resolver (`resolveActorTrust`) reads the IO-free guardian-
+ * delivery cache snapshot (`peekCachedGuardianDelivery`) keyed per channel
+ * filter. On a cold process only `vellum` is warmed at daemon startup, so for
+ * `phone` the snapshot is empty until some read warms that exact channel key.
+ * The voice setup path therefore awaits
+ * `getGuardianDeliveryFresh({ channelTypes: ["phone"] })` BEFORE the sync
+ * resolve so an inbound guardian call classifies as `guardian` rather than
+ * misclassifying during a gateway verdict blip. It reads FRESH because gateway-
+ * side binding writes don't invalidate the daemon cache: a stale empty snapshot
+ * from an earlier setup would otherwise survive the TTL.
+ *
+ * This test drives the REAL guardian-delivery reader cache (mocking only the
+ * gateway `ipcCall`) so the cold→warm transition is exercised end to end.
+ */
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+const GUARDIAN_PHONE = "+15550100";
+
+// Gateway IPC stub: returns the phone guardian delivery. The real reader caches
+// the result under the `phone` key, so a subsequent sync `peek` finds it. When
+// `guardianBound` is false the gateway reports no guardian — simulating the
+// pre-binding state whose empty result the cache would otherwise pin.
+let guardianBound = true;
+let ipcCalls: Array<{ route: string; input: unknown }> = [];
+mock.module("../ipc/gateway-client.js", () => ({
+  ipcCall: async (route: string, input: unknown) => {
+    ipcCalls.push({ route, input });
+    return {
+      guardians: guardianBound
+        ? [
+            {
+              channelType: "phone",
+              contactId: "guardian-contact",
+              principalId: "P_GUARDIAN_COLD",
+              address: GUARDIAN_PHONE,
+              externalChatId: null,
+              status: "active",
+            },
+          ]
+        : [],
+    };
+  },
+}));
+
+// Member lookup is irrelevant to guardian classification (address match on the
+// cached delivery decides it); return null so the member path is a no-op.
+mock.module("../contacts/contact-store.js", () => ({
+  findContactByAddress: () => null,
+}));
+
+import {
+  __resetGuardianDeliveryCacheForTest,
+  getGuardianDelivery,
+  getGuardianDeliveryFresh,
+  peekCachedGuardianDelivery,
+} from "../contacts/guardian-delivery-reader.js";
+import { resolveActorTrust } from "../runtime/actor-trust-resolver.js";
+
+describe("voice path warms the phone guardian cache before sync trust", () => {
+  beforeEach(() => {
+    __resetGuardianDeliveryCacheForTest();
+    ipcCalls = [];
+    guardianBound = true;
+  });
+
+  test("cold phone cache: guardian call misclassifies until upstream warm", async () => {
+    // Precondition: cold cache for phone — the sync peek would miss.
+    expect(
+      peekCachedGuardianDelivery({ channelTypes: ["phone"] }),
+    ).toBeUndefined();
+
+    // Sync resolve on a cold cache: no guardian snapshot → classified unknown.
+    const cold = resolveActorTrust({
+      assistantId: "asst-1",
+      sourceChannel: "phone",
+      conversationExternalId: GUARDIAN_PHONE,
+      actorExternalId: GUARDIAN_PHONE,
+    });
+    expect(cold.trustClass).toBe("unknown");
+
+    // The voice setup path warms the phone-specific key via the fresh reader.
+    await getGuardianDeliveryFresh({ channelTypes: ["phone"] });
+    expect(
+      ipcCalls.some(
+        (c) =>
+          c.route === "resolve_guardian_delivery" &&
+          JSON.stringify(c.input) ===
+            JSON.stringify({ channelTypes: ["phone"] }),
+      ),
+    ).toBe(true);
+
+    // The sync resolve, reading the now-warm snapshot, classifies the caller as
+    // the guardian — not misclassified as `unknown`.
+    const warm = resolveActorTrust({
+      assistantId: "asst-1",
+      sourceChannel: "phone",
+      conversationExternalId: GUARDIAN_PHONE,
+      actorExternalId: GUARDIAN_PHONE,
+    });
+    expect(warm.trustClass).toBe("guardian");
+  });
+
+  test("fresh warm bypasses a stale empty phone snapshot after a gateway-side binding", async () => {
+    // An earlier setup cached an empty phone snapshot (no guardian yet). Gateway-
+    // side binding writes don't invalidate the daemon cache, so the entry stays
+    // warm-but-stale until the TTL.
+    guardianBound = false;
+    await getGuardianDelivery({ channelTypes: ["phone"] });
+    expect(peekCachedGuardianDelivery({ channelTypes: ["phone"] })).toEqual([]);
+
+    // Guardian binding now exists gateway-side. A non-force read would still
+    // return the pinned empty snapshot; the fresh read bypasses it.
+    guardianBound = true;
+    expect(await getGuardianDelivery({ channelTypes: ["phone"] })).toEqual([]);
+    await getGuardianDeliveryFresh({ channelTypes: ["phone"] });
+
+    // The sync resolve now reads the refreshed snapshot and classifies guardian.
+    const warm = resolveActorTrust({
+      assistantId: "asst-1",
+      sourceChannel: "phone",
+      conversationExternalId: GUARDIAN_PHONE,
+      actorExternalId: GUARDIAN_PHONE,
+    });
+    expect(warm.trustClass).toBe("guardian");
+  });
+
+  test("startup vellum-only warm leaves the phone key cold", async () => {
+    // Daemon startup warms only `vellum`; that must not populate the `phone` key.
+    await getGuardianDelivery({ channelTypes: ["vellum"] });
+    expect(
+      peekCachedGuardianDelivery({ channelTypes: ["phone"] }),
+    ).toBeUndefined();
+  });
+});

package/src/__tests__/voice-invite-redemption.test.ts

@@ -14,6 +14,12 @@ const gatewayIpc = {
     mirrored: boolean;
   },
   claimThrows: false,
+  // When set, contacts_get_rich throws (gateway read unreachable) so the
+  // gate-status fallback must fail open.
+  richThrows: false,
+  // When set, overrides the contacts_get_rich response (e.g. a gateway row
+  // under a divergent UUID for the same (type,address)).
+  richOverride: null as ((contactId: string | undefined) => unknown) | null,
   // Drives the upsert_verified_channel relay verdict; false refuses the actor.
   activationVerified: true,
   calls: [] as { method: string; params?: Record<string, unknown> }[],
@@ -25,6 +31,13 @@ mock.module("../ipc/gateway-client.js", () => ({
     params?: Record<string, unknown>,
   ) => {
     gatewayIpc.calls.push({ method, params });
+    if (method === "contacts_get_rich") {
+      if (gatewayIpc.richThrows) throw new Error("gateway read unreachable");
+      if (gatewayIpc.richOverride) {
+        return gatewayIpc.richOverride(params?.contactId as string);
+      }
+      return richContactForId(params?.contactId as string);
+    }
     if (method === "record_invite_redemption") {
       if (gatewayIpc.claimThrows) throw new Error("gateway unreachable");
       return gatewayIpc.claim;
@@ -39,9 +52,90 @@ mock.module("../ipc/gateway-client.js", () => ({
   },
 }));
 
+// Serves contacts_get_rich (the gateway ACL read backing the gate-status
+// fallback) from the seeded local contact, so gate resolution sources status
+// from the gateway path rather than the local channel column.
+function richContactForId(contactId: string | undefined) {
+  if (!contactId) return undefined;
+  const contact = getContact(contactId);
+  if (!contact) return undefined;
+  // ACL columns live on the still-present DB rows, not the slimmed interfaces;
+  // read them raw to build the gateway-rich response the production read parses.
+  const contactRole = (
+    getSqlite()
+      .query("SELECT role FROM contacts WHERE id = ?")
+      .get(contact.id) as { role: string } | undefined
+  )?.role;
+  return {
+    ok: true,
+    contact: {
+      id: contact.id,
+      displayName: contact.displayName,
+      role: contactRole ?? "contact",
+      interactionCount: contact.interactionCount,
+      createdAt: contact.createdAt,
+      updatedAt: contact.updatedAt,
+      channels: contact.channels.map((c) => {
+        const acl = rawChannelAcl(c.id);
+        return {
+          id: c.id,
+          contactId: c.contactId,
+          type: c.type,
+          address: c.address,
+          isPrimary: c.isPrimary,
+          externalUserId: c.externalChatId,
+          status: acl.status,
+          policy: acl.policy,
+          verifiedAt: acl.verifiedAt,
+          verifiedVia: acl.verifiedVia,
+          lastSeenAt: acl.lastSeenAt,
+          interactionCount: acl.interactionCount,
+          lastInteraction: acl.lastInteraction,
+          revokedReason: acl.revokedReason,
+          blockedReason: acl.blockedReason,
+        };
+      }),
+    },
+  };
+}
+
+/** Read a channel's ACL columns straight off the still-present DB row. */
+function rawChannelAcl(channelId: string) {
+  return getSqlite()
+    .query(
+      `SELECT status, policy, verified_at AS verifiedAt, verified_via AS verifiedVia,
+              last_seen_at AS lastSeenAt, interaction_count AS interactionCount,
+              last_interaction AS lastInteraction, revoked_reason AS revokedReason,
+              blocked_reason AS blockedReason
+         FROM contact_channels WHERE id = ?`,
+    )
+    .get(channelId) as {
+    status: string;
+    policy: string;
+    verifiedAt: number | null;
+    verifiedVia: string | null;
+    lastSeenAt: number | null;
+    interactionCount: number;
+    lastInteraction: number | null;
+    revokedReason: string | null;
+    blockedReason: string | null;
+  };
+}
+
+/** Read a contact's local role column (dropped from the Contact interface). */
+function localContactRole(contactId: string): string | undefined {
+  return (
+    getSqlite()
+      .query("SELECT role FROM contacts WHERE id = ?")
+      .get(contactId) as { role: string } | undefined
+  )?.role;
+}
+
 function resetGatewayIpc() {
   gatewayIpc.claim = { ok: true, updated: true, mirrored: true };
   gatewayIpc.claimThrows = false;
+  gatewayIpc.richThrows = false;
+  gatewayIpc.richOverride = null;
   gatewayIpc.activationVerified = true;
   gatewayIpc.calls = [];
 }
@@ -51,12 +145,12 @@ import {
   getContact,
   upsertContact,
 } from "../contacts/contact-store.js";
-import { upsertContactChannel } from "../contacts/contacts-write.js";
 import { getSqlite } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import { createInvite, revokeInvite } from "../memory/invite-store.js";
 import { redeemVoiceInviteCode } from "../runtime/invite-redemption-service.js";
 import { generateVoiceCode, hashVoiceCode } from "../util/voice-code.js";
+import { seedContactChannel } from "./helpers/seed-contact-channel.js";
 
 await initializeDb();
 
@@ -292,6 +386,83 @@ describe("redeemVoiceInviteCode", () => {
     ).not.toBeNull();
   });
 
+  test("matches an active member by (type,address) when the gateway row has a divergent uuid", async () => {
+    const phone = "+15551234567";
+    const member = seedContactChannel({
+      sourceChannel: "phone",
+      externalUserId: phone,
+      status: "active",
+    });
+    const { code } = createVoiceInvite({
+      callerPhone: phone,
+      contactId: member.contactId,
+    });
+
+    // Gateway row for the same (type,address) under a DIFFERENT id.
+    gatewayIpc.richOverride = () => ({
+      ok: true,
+      contact: {
+        id: member.contactId,
+        displayName: phone,
+        role: "contact",
+        interactionCount: 0,
+        createdAt: 1,
+        updatedAt: 1,
+        channels: [
+          {
+            id: "gateway-divergent-uuid",
+            contactId: member.contactId,
+            type: "phone",
+            address: phone,
+            isPrimary: false,
+            externalUserId: null,
+            status: "active",
+            policy: "allow",
+            verifiedAt: 1,
+            verifiedVia: "invite",
+            lastSeenAt: null,
+            interactionCount: 0,
+            lastInteraction: null,
+            revokedReason: null,
+            blockedReason: null,
+          },
+        ],
+      },
+    });
+
+    const result = await redeemVoiceInviteCode({
+      callerExternalUserId: phone,
+      sourceChannel: "phone",
+      code,
+    });
+
+    expect(result.ok).toBe(true);
+    expect((result as { type: string }).type).toBe("already_member");
+  });
+
+  test("fails open (no throw) when the gateway gate-status read is unreachable", async () => {
+    const phone = "+15551234567";
+    const member = seedContactChannel({
+      sourceChannel: "phone",
+      externalUserId: phone,
+      status: "revoked",
+    });
+    const { code } = createVoiceInvite({
+      callerPhone: phone,
+      contactId: member.contactId,
+    });
+
+    gatewayIpc.richThrows = true;
+
+    const result = await redeemVoiceInviteCode({
+      callerExternalUserId: phone,
+      sourceChannel: "phone",
+      code,
+    });
+
+    expect(result.ok).toBe(true);
+  });
+
   test("marks channel as verified via invite on voice redemption", async () => {
     const phone = "+15551234567";
     const { code } = createVoiceInvite({ callerPhone: phone });
@@ -304,15 +475,12 @@ describe("redeemVoiceInviteCode", () => {
 
     expect(result.ok).toBe(true);
 
+    // The gateway owns the verified ACL verdict; the local mirror is identity-only.
     const channelResult = findContactChannel({
       channelType: "phone",
       address: phone,
     });
-
     expect(channelResult).not.toBeNull();
-    expect(channelResult!.channel.verifiedAt).toBeGreaterThan(0);
-    expect(channelResult!.channel.verifiedVia).toBe("invite");
-    expect(channelResult!.channel.status).toBe("active");
   });
 
   test("wrong caller identity fails with generic error", async () => {
@@ -420,7 +588,7 @@ describe("redeemVoiceInviteCode", () => {
     const phone = "+15551234567";
 
     // Pre-create an active member for this phone on voice channel
-    const member = upsertContactChannel({
+    const member = seedContactChannel({
       sourceChannel: "phone",
       externalUserId: phone,
       status: "active",
@@ -430,7 +598,7 @@ describe("redeemVoiceInviteCode", () => {
     // Create a voice invite targeting the same contact that owns the channel
     const { code } = createVoiceInvite({
       callerPhone: phone,
-      contactId: member!.contact.id,
+      contactId: member.contactId,
     });
 
     const result = await redeemVoiceInviteCode({
@@ -456,7 +624,7 @@ describe("redeemVoiceInviteCode", () => {
     const phone = "+15551234567";
 
     // Pre-create a blocked member and find their contact
-    const member = upsertContactChannel({
+    const member = seedContactChannel({
       sourceChannel: "phone",
       externalUserId: phone,
       status: "blocked",
@@ -466,7 +634,7 @@ describe("redeemVoiceInviteCode", () => {
     // Create a voice invite targeting the same contact that owns the channel
     const { code } = createVoiceInvite({
       callerPhone: phone,
-      contactId: member!.contact.id,
+      contactId: member.contactId,
     });
 
     const result = await redeemVoiceInviteCode({
@@ -492,16 +660,12 @@ describe("redeemVoiceInviteCode", () => {
     const phone = "+15559998888";
 
     // Pre-create a guardian contact with a revoked phone channel
-    const guardianContact = upsertContact({
+    const guardianSeed = seedContactChannel({
+      sourceChannel: "phone",
+      externalUserId: phone,
       displayName: "Guardian",
       role: "guardian",
-      channels: [
-        {
-          type: "phone",
-          address: phone,
-          status: "revoked",
-        },
-      ],
+      status: "revoked",
     });
 
     // Create a separate target contact "Mom"
@@ -533,11 +697,10 @@ describe("redeemVoiceInviteCode", () => {
     });
     expect(contactResult).not.toBeNull();
     expect(contactResult!.contact.id).toBe(momContact.id);
-    expect(contactResult!.channel.status).toBe("active");
 
     // Verify the original guardian contact was NOT modified
-    const guardian = getContact(guardianContact.id);
+    const guardian = getContact(guardianSeed.contactId);
     expect(guardian).not.toBeNull();
-    expect(guardian!.role).toBe("guardian");
+    expect(localContactRole(guardianSeed.contactId)).toBe("guardian");
   });
 });

package/src/__tests__/workspace-migration-102-preserve-heartbeat-enabled-for-existing-workspaces.test.ts

@@ -55,11 +55,11 @@ describe("102-preserve-heartbeat-enabled-for-existing-workspaces migration", ()
     ).toContain("heartbeat.enabled");
   });
 
-  test("schema default is disabled (the flip this migration compensates for)", () => {
-    expect(HeartbeatConfigSchema.parse({}).enabled).toBe(false);
+  test("schema default is enabled", () => {
+    expect(HeartbeatConfigSchema.parse({}).enabled).toBe(true);
   });
 
-  test("skips fresh workspaces so new users get the opt-in default", () => {
+  test("skips fresh workspaces so new users inherit the schema default", () => {
     preserveHeartbeatEnabledForExistingWorkspacesMigration.run(
       workspaceDir,
       NEW_WORKSPACE_CTX,

package/src/__tests__/workspace-migration-111-prune-seeded-callsite-defaults.test.ts

@@ -110,8 +110,8 @@ afterEach(() => {
 });
 
 describe("111-prune-seeded-callsite-defaults migration", () => {
-  test("is registered last", () => {
-    expect(WORKSPACE_MIGRATIONS.at(-1)).toBe(
+  test("is registered", () => {
+    expect(WORKSPACE_MIGRATIONS).toContain(
       pruneSeededCallsiteDefaultsMigration,
     );
   });

package/src/__tests__/workspace-migration-112-remove-advisor-callsite-override.test.ts

@@ -0,0 +1,170 @@
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import { removeAdvisorCallsiteOverrideMigration } from "../workspace/migrations/112-remove-advisor-callsite-override.js";
+
+let workspaceDir: string;
+
+function writeConfig(data: Record<string, unknown>): void {
+  writeFileSync(
+    join(workspaceDir, "config.json"),
+    JSON.stringify(data, null, 2) + "\n",
+  );
+}
+
+function readConfig(): Record<string, unknown> {
+  return JSON.parse(readFileSync(join(workspaceDir, "config.json"), "utf-8"));
+}
+
+beforeEach(() => {
+  workspaceDir = join(
+    tmpdir(),
+    `vellum-migration-111-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+  );
+  mkdirSync(workspaceDir, { recursive: true });
+});
+
+afterEach(() => {
+  if (existsSync(workspaceDir)) {
+    rmSync(workspaceDir, { recursive: true, force: true });
+  }
+});
+
+describe("112-remove-advisor-callsite-override migration", () => {
+  test("has correct migration id and description", () => {
+    expect(removeAdvisorCallsiteOverrideMigration.id).toBe(
+      "112-remove-advisor-callsite-override",
+    );
+    expect(removeAdvisorCallsiteOverrideMigration.description).toBe(
+      "Remove the stale advisor entry from llm.callSites (advisor call site removed)",
+    );
+  });
+
+  // ─── No-op cases ────────────────────────────────────────────────────────
+
+  test("no-op when config.json does not exist", () => {
+    removeAdvisorCallsiteOverrideMigration.run(workspaceDir);
+    expect(existsSync(join(workspaceDir, "config.json"))).toBe(false);
+  });
+
+  test("gracefully handles invalid JSON", () => {
+    writeFileSync(join(workspaceDir, "config.json"), "not-valid-json");
+    removeAdvisorCallsiteOverrideMigration.run(workspaceDir);
+    expect(readFileSync(join(workspaceDir, "config.json"), "utf-8")).toBe(
+      "not-valid-json",
+    );
+  });
+
+  test("no-op when config has no llm.callSites", () => {
+    const original = { llm: { default: { provider: "anthropic" } } };
+    writeConfig(original);
+    removeAdvisorCallsiteOverrideMigration.run(workspaceDir);
+    expect(readConfig()).toEqual(original);
+  });
+
+  test("no-op when llm.callSites has no advisor key", () => {
+    const original = {
+      llm: {
+        callSites: {
+          mainAgent: { profile: "quality-optimized" },
+          memoryRouter: { profile: "latency-optimized" },
+        },
+      },
+    };
+    writeConfig(original);
+    removeAdvisorCallsiteOverrideMigration.run(workspaceDir);
+    expect(readConfig()).toEqual(original);
+  });
+
+  test("gracefully handles non-object llm / callSites shapes", () => {
+    const original = { llm: { callSites: 42 } };
+    writeConfig(original);
+    removeAdvisorCallsiteOverrideMigration.run(workspaceDir);
+    expect(readConfig()).toEqual(original);
+  });
+
+  // ─── Removal ────────────────────────────────────────────────────────────
+
+  test("removes advisor and prunes the now-empty callSites map", () => {
+    writeConfig({
+      llm: {
+        callSites: {
+          advisor: { profile: "quality-optimized" },
+        },
+        advisorProfile: "frontier",
+      },
+    });
+
+    removeAdvisorCallsiteOverrideMigration.run(workspaceDir);
+
+    const llm = readConfig().llm as Record<string, unknown>;
+    expect("callSites" in llm).toBe(false);
+    // The unrelated top-level advisor profile selection is untouched.
+    expect(llm.advisorProfile).toBe("frontier");
+  });
+
+  test("removes advisor but preserves other callSites keys", () => {
+    writeConfig({
+      llm: {
+        callSites: {
+          advisor: { profile: "quality-optimized" },
+          mainAgent: { profile: "opus" },
+          memoryRouter: { profile: "latency-optimized" },
+        },
+      },
+    });
+
+    removeAdvisorCallsiteOverrideMigration.run(workspaceDir);
+
+    const callSites = (readConfig().llm as Record<string, unknown>)
+      .callSites as Record<string, unknown>;
+    expect("advisor" in callSites).toBe(false);
+    expect(callSites.mainAgent).toEqual({ profile: "opus" });
+    expect(callSites.memoryRouter).toEqual({ profile: "latency-optimized" });
+  });
+
+  // ─── Idempotency ────────────────────────────────────────────────────────
+
+  test("idempotency: re-running yields no further mutation", () => {
+    writeConfig({
+      llm: {
+        callSites: {
+          advisor: { profile: "quality-optimized" },
+          mainAgent: { profile: "opus" },
+        },
+      },
+    });
+
+    removeAdvisorCallsiteOverrideMigration.run(workspaceDir);
+    const afterFirst = readConfig();
+
+    removeAdvisorCallsiteOverrideMigration.run(workspaceDir);
+    const afterSecond = readConfig();
+
+    expect(afterSecond).toEqual(afterFirst);
+  });
+
+  test("idempotency: writes nothing on a config without the advisor key", () => {
+    writeConfig({
+      llm: { callSites: { mainAgent: { profile: "opus" } } },
+    });
+    const beforeContent = readFileSync(
+      join(workspaceDir, "config.json"),
+      "utf-8",
+    );
+
+    removeAdvisorCallsiteOverrideMigration.run(workspaceDir);
+
+    expect(readFileSync(join(workspaceDir, "config.json"), "utf-8")).toBe(
+      beforeContent,
+    );
+  });
+});