@vellumai/assistant 0.10.4-dev.202607012136.5ef7865 → 0.10.4-dev.202607012335.d6d6958

package/node_modules/@vellumai/gateway-client/src/index.ts

@@ -77,6 +77,7 @@ export type { AdmissionPolicy } from "./admission-policy-contract.js";
 
 // Trust verdict contract (gateway → daemon) — Zod schemas + derived types
 export {
+  isTrustClass,
   makeResolutionFailedVerdict,
   ResolveInboundTrustRequestSchema,
   TRUST_CLASS_VALUES,

package/node_modules/@vellumai/gateway-client/src/trust-verdict-contract.ts

@@ -32,6 +32,18 @@ export const TrustClassSchema = z.enum(TRUST_CLASS_VALUES);
 
 export type TrustClass = (typeof TRUST_CLASS_VALUES)[number];
 
+const TRUST_CLASS_SET: ReadonlySet<string> = new Set(TRUST_CLASS_VALUES);
+
+/**
+ * Type guard for wire-sourced trust classes. Consumers receive verdicts over
+ * IPC/HTTP, so a field statically typed {@link TrustClass} can still carry an
+ * out-of-contract value (version skew, malformed payload); this narrows it
+ * safely without casting.
+ */
+export function isTrustClass(value: string): value is TrustClass {
+  return TRUST_CLASS_SET.has(value);
+}
+
 /**
  * Per-actor trust verdict resolved by the gateway from its ACL DB. ACL +
  * identity keys + minimal labels only. Guardian binding and member
@@ -42,9 +54,10 @@ export const TrustVerdictSchema = z.object({
   trustClass: TrustClassSchema,
   canonicalSenderId: z.string().nullable(),
 
-  // Present+true ⇒ gateway attempted resolution but failed (DB error);
-  // consumer treats it as "could not vouch", distinct from a real `unknown`
-  // stranger.
+  // Present+true ⇒ gateway attempted resolution but could not produce a
+  // usable verdict (DB error, or a sender who maps to the guardian contact
+  // whose principal is unresolved); consumer treats it as "could not vouch",
+  // distinct from a real `unknown` stranger.
   resolutionFailed: z.boolean().optional(),
 
   // Guardian binding — present only when a guardian binding matches.

package/openapi.yaml

@@ -21119,6 +21119,11 @@ paths:
                         name:
                           type: string
                           description: Display name. Equal to `id` today.
+                        enabled:
+                          type: boolean
+                          description:
+                            Whether the plugin is active in this workspace. `false` when a `.disabled` sentinel is present under its
+                            directory; `true` otherwise.
                         description:
                           anyOf:
                             - type: string
@@ -21147,6 +21152,7 @@ paths:
                       required:
                         - id
                         - name
+                        - enabled
                         - description
                         - version
                       additionalProperties: false
@@ -21430,6 +21436,80 @@ paths:
           description: The install recorded no commit or no fingerprint to re-materialize and verify a baseline from.
         "503":
           description: The plugin source (GitHub) was temporarily unavailable; the diff is retryable.
+  /v1/plugins/{name}/disable:
+    post:
+      operationId: plugins_by_name_disable_post
+      summary: Disable a plugin
+      description:
+        Disable a plugin in this workspace by dropping a `.disabled` sentinel, mirroring the CLI's `assistant
+        plugins disable <name>`. The change is honored live at read time by every tool / injector / hook gate — no
+        restart required. Broadcasts a `sync_changed` invalidation carrying the `plugins:list` tag so other clients
+        refetch `GET /v1/plugins`. An already-disabled plugin returns 409; a user plugin with no directory returns 404
+        (default plugins are stubbed on demand via the `default-` prefix); a malformed name returns 400.
+      tags:
+        - plugins
+      parameters:
+        - name: name
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  ok:
+                    type: boolean
+                required:
+                  - ok
+                additionalProperties: false
+        "400":
+          description: The plugin name failed validation (not kebab-case alphanumerics).
+        "404":
+          description: No plugin directory exists with the given name (user plugins must already be installed).
+        "409":
+          description: The plugin is already disabled.
+  /v1/plugins/{name}/enable:
+    post:
+      operationId: plugins_by_name_enable_post
+      summary: Enable a plugin
+      description:
+        Enable a plugin in this workspace by removing its `.disabled` sentinel, mirroring the CLI's `assistant
+        plugins enable <name>`. The change is honored live at read time by every tool / injector / hook gate — no
+        restart required. Broadcasts a `sync_changed` invalidation carrying the `plugins:list` tag so other clients
+        refetch `GET /v1/plugins`. An already-enabled plugin returns 409; a name with no plugin directory returns 404
+        (prefix a default plugin with `default-`); a malformed name returns 400.
+      tags:
+        - plugins
+      parameters:
+        - name: name
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  ok:
+                    type: boolean
+                required:
+                  - ok
+                additionalProperties: false
+        "400":
+          description: The plugin name failed validation (not kebab-case alphanumerics).
+        "404":
+          description: No plugin directory exists with the given name.
+        "409":
+          description: The plugin is already enabled.
   /v1/plugins/{name}/inspect:
     get:
       operationId: plugins_by_name_inspect_get

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.10.4-dev.202607012136.5ef7865",
+  "version": "0.10.4-dev.202607012335.d6d6958",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/approval-interception-trust-gates.test.ts

@@ -24,8 +24,14 @@ mock.module("../daemon/conversation-registry.js", () => ({
   findConversation: (id: string) => _conversationMocks.get(id),
 }));
 
+// Anchored guardian principal, driven per-test to exercise the guardian
+// principal gate (undefined = anchor unresolvable).
+let _anchorPrincipalId: string | undefined;
+mock.module("../runtime/local-actor-identity.js", () => ({
+  findLocalGuardianPrincipalId: async () => _anchorPrincipalId,
+}));
+
 import type { Conversation } from "../daemon/conversation.js";
-import type { TrustContext } from "../daemon/trust-context.js";
 import { initializeDb } from "../persistence/db-init.js";
 import * as approvalMessageComposer from "../runtime/approval-message-composer.js";
 import * as gatewayClient from "../runtime/gateway-client.js";
@@ -76,6 +82,7 @@ describe("approval interception trust-class gates", () => {
 
   beforeEach(() => {
     pendingInteractions.clear();
+    _anchorPrincipalId = undefined;
     deliverSpy = spyOn(gatewayClient, "deliverChannelReply").mockResolvedValue({
       ok: true,
     });
@@ -105,7 +112,7 @@ describe("approval interception trust-class gates", () => {
         trustClass: "unknown",
         requesterExternalUserId: "intruder-user-1",
         guardianExternalUserId: "guardian-1",
-      } as TrustContext,
+      },
       assistantId: ASSISTANT_ID,
     });
 
@@ -117,6 +124,144 @@ describe("approval interception trust-class gates", () => {
     composeSpy.mockRestore();
   });
 
+  test("guardian apr: callback with a principal matching the anchor applies the decision", async () => {
+    _anchorPrincipalId = "guardian-principal-1";
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-apply-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-apply-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "guardian-user-1",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "guardian-user-1",
+        guardianExternalUserId: "guardian-user-1",
+        guardianPrincipalId: "guardian-principal-1",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("decision_applied");
+    expect(sessionMock).toHaveBeenCalled();
+  });
+
+  test("guardian apr: callback with a principal NOT matching the anchor is rejected before any decision", async () => {
+    _anchorPrincipalId = "the-real-guardian-principal";
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-mismatch-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-mismatch-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "stale-guardian-user",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "stale-guardian-user",
+        guardianExternalUserId: "stale-guardian-user",
+        guardianPrincipalId: "some-other-principal",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("stale_ignored");
+    expect(sessionMock).not.toHaveBeenCalled();
+    // Generic failure copy — no oracle about pending requests or permission.
+    expect(deliverSpy).toHaveBeenCalledWith(
+      "https://gateway.test/deliver",
+      expect.objectContaining({
+        text: "Sorry, I couldn't process that. Please try again.",
+      }),
+    );
+  });
+
+  test("guardian without a resolved acting principal is rejected before any decision", async () => {
+    // Address-only guardian classification (e.g. a binding row with a null
+    // principal) must not authorize decisions.
+    _anchorPrincipalId = "the-real-guardian-principal";
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-no-principal-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-no-principal-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "guardian-user-1",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "guardian-user-1",
+        guardianExternalUserId: "guardian-user-1",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("stale_ignored");
+    expect(sessionMock).not.toHaveBeenCalled();
+  });
+
+  test("guardian decision defers to the verdict when the anchor read is unresolvable", async () => {
+    // Transient gateway miss on the anchor read: the gateway-stamped verdict
+    // (which already classified the actor guardian by principal) wins.
+    _anchorPrincipalId = undefined;
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-anchor-miss-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-anchor-miss-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "guardian-user-1",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "guardian-user-1",
+        guardianExternalUserId: "guardian-user-1",
+        guardianPrincipalId: "guardian-principal-1",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("decision_applied");
+    expect(sessionMock).toHaveBeenCalled();
+  });
+
   test("unverified sender (no identity) auto-denies pending approval", async () => {
     const sessionMock = registerPendingInteraction(
       "req-unknown-auto-deny-1",
@@ -135,7 +280,7 @@ describe("approval interception trust-class gates", () => {
       trustCtx: {
         sourceChannel: "telegram",
         trustClass: "unknown",
-      } as TrustContext,
+      },
       assistantId: ASSISTANT_ID,
     });
 

package/src/__tests__/context-search-conversations-source.test.ts

@@ -2,13 +2,12 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { writeSlackMetadata } from "../messaging/providers/slack/message-metadata.js";
 import type { MessageLexicalSearchResult } from "../persistence/embeddings/messages-lexical-index.js";
-import { setOverridesForTesting } from "./feature-flag-test-helpers.js";
 
 // Mutable stand-in for the Qdrant lexical candidate helper. The default
 // throws so any qdrant-path test that forgets to set an implementation fails
 // loudly rather than silently exercising an empty candidate set. FTS-path
-// tests never reach it (the flag defaults to fts5), so its value is irrelevant
-// there.
+// tests never reach it (fts5 is used until the backfill completes), so its
+// value is irrelevant there.
 let lexicalMockImpl: (
   query: string,
   limit: number,
@@ -99,7 +98,10 @@ describe("searchConversationSource", () => {
     });
   });
 
-  test("uses LIKE fallback for short and non-ASCII queries", async () => {
+  test("returns no evidence for short and non-ASCII queries (content matching is index-only)", async () => {
+    // Short/punctuation-only and CJK queries produce no usable ≥2-char match
+    // shape. There is no content-scan fallback, so such queries yield no
+    // conversation evidence even when an exact substring exists.
     await seedConversation({
       title: "C++ notes",
       role: "user",
@@ -117,12 +119,8 @@ describe("searchConversationSource", () => {
       5,
     );
 
-    expect(shortResult.evidence.map((item) => item.title)).toEqual([
-      "C++ notes",
-    ]);
-    expect(unicodeResult.evidence.map((item) => item.title)).toEqual([
-      "Unicode notes",
-    ]);
+    expect(shortResult.evidence).toEqual([]);
+    expect(unicodeResult.evidence).toEqual([]);
   });
 
   test("does not return derived subagent, auto-analysis, or notification conversations", async () => {
@@ -203,27 +201,6 @@ describe("searchConversationSource", () => {
     ]);
   });
 
-  test("excludes legacy private conversations through the LIKE fallback", async () => {
-    const visible = await seedConversation({
-      title: "Visible non-ASCII conversation",
-      content: "東京 appears in a normal conversation.",
-    });
-    const legacyPrivate = await seedConversation({
-      title: "Legacy private non-ASCII conversation",
-      content: "東京 appears in a private conversation.",
-    });
-    rawRun(
-      "UPDATE conversations SET conversation_type = 'private' WHERE id = ?",
-      legacyPrivate.conversation.id,
-    );
-
-    const result = await searchConversationSource("東京", makeContext(), 10);
-
-    expect(result.evidence.map((item) => item.locator)).toEqual([
-      `${visible.conversation.id}#${visible.message.id}`,
-    ]);
-  });
-
   test("includes archived, scheduled, and background conversations", async () => {
     const archived = await seedConversation({
       title: "Archived conversation",
@@ -407,14 +384,13 @@ describe("searchConversationSource with the qdrant backend", () => {
     getDb().run("DELETE FROM conversations");
     lexicalCalls = [];
     suppressIndexing = false;
-    // These tests exercise the populated-index (post-backfill) qdrant path, so
-    // mark the backfill complete. The completion gate is covered by its own test.
+    // The qdrant backend is selected once the index is populated: not suppressed
+    // + backfill complete. These tests exercise that post-backfill path, so mark
+    // the backfill complete. The completion gate is covered by its own test.
     setMemoryCheckpoint(LEXICAL_BACKFILL_COMPLETE_KEY, "1");
-    setOverridesForTesting({ "messages-search-backend": true });
   });
 
   afterEach(() => {
-    setOverridesForTesting({});
     suppressIndexing = false;
     deleteMemoryCheckpoint(LEXICAL_BACKFILL_COMPLETE_KEY);
     lexicalMockImpl = () => {
@@ -424,7 +400,7 @@ describe("searchConversationSource with the qdrant backend", () => {
     };
   });
 
-  test("falls back to FTS when memory indexing is suppressed, even with the qdrant flag on", async () => {
+  test("falls back to FTS when memory indexing is suppressed", async () => {
     const match = await seedConversation({
       title: "Suppressed indexing notes",
       content: "The suppressedtoken decision is recorded here.",
@@ -451,7 +427,7 @@ describe("searchConversationSource with the qdrant backend", () => {
     ]);
   });
 
-  test("falls back to FTS until the backfill completion checkpoint is set, even with the qdrant flag on", async () => {
+  test("falls back to FTS until the backfill completion checkpoint is set", async () => {
     const match = await seedConversation({
       title: "Pre-backfill notes",
       content: "The prebackfilltoken decision is recorded here.",
@@ -480,16 +456,17 @@ describe("searchConversationSource with the qdrant backend", () => {
     ]);
   });
 
-  test("routes short/punctuation-only queries to the exact LIKE path, not Qdrant", async () => {
-    const match = await seedConversation({
+  test("short/punctuation-only queries return no evidence and never hit Qdrant", async () => {
+    await seedConversation({
       title: "C++ notes",
       role: "user",
       content: "Use C++ when the example needs deterministic lifetime notes.",
     });
 
-    // `C++` produces no usable ≥2-char FTS match shape, so the source must use
-    // the exact LIKE path rather than the sparse encoder (which would still
-    // emit a noisy 1-char `c` token). The mock throws to prove it never runs.
+    // `C++` produces no usable ≥2-char FTS match shape. The sparse encoder
+    // would still emit a noisy 1-char `c` token, so the source must return no
+    // evidence WITHOUT querying the index. The mock throws to prove it never
+    // runs.
     lexicalMockImpl = async () => {
       throw new Error("searchMessageIdsLexical must not run for a short query");
     };
@@ -497,9 +474,7 @@ describe("searchConversationSource with the qdrant backend", () => {
     const result = await searchConversationSource("C++", makeContext(), 5);
 
     expect(lexicalCalls).toHaveLength(0);
-    expect(result.evidence.map((item) => item.locator)).toEqual([
-      `${match.conversation.id}#${match.message.id}`,
-    ]);
+    expect(result.evidence).toEqual([]);
   });
 
   test("over-fetches a wide candidate pool from Qdrant, not the FTS prefetch window", async () => {
@@ -622,10 +597,10 @@ describe("searchConversationSource with the qdrant backend", () => {
     ]);
   });
 
-  test("falls back to LIKE when the Qdrant lookup throws", async () => {
-    const match = await seedConversation({
-      title: "Fallback notes",
-      content: "The likefallbacktoken decision is recorded here.",
+  test("returns no evidence when the Qdrant lookup throws", async () => {
+    await seedConversation({
+      title: "Failure notes",
+      content: "The qdranterrortoken decision is recorded here.",
     });
 
     lexicalMockImpl = async () => {
@@ -633,18 +608,18 @@ describe("searchConversationSource with the qdrant backend", () => {
     };
 
     const result = await searchConversationSource(
-      "likefallbacktoken",
+      "qdranterrortoken",
       makeContext(),
       5,
     );
 
-    expect(result.evidence.map((item) => item.locator)).toEqual([
-      `${match.conversation.id}#${match.message.id}`,
-    ]);
+    // Content matching is index-only: the failure is logged and the source
+    // yields no conversation evidence — no content-scan recovery.
+    expect(result.evidence).toEqual([]);
   });
 
-  test("falls back to LIKE when Qdrant returns no candidates", async () => {
-    const match = await seedConversation({
+  test("returns no evidence when Qdrant returns no candidates", async () => {
+    await seedConversation({
       title: "Empty candidate notes",
       content: "The emptycandidatetoken decision is recorded here.",
     });
@@ -657,9 +632,9 @@ describe("searchConversationSource with the qdrant backend", () => {
       5,
     );
 
-    expect(result.evidence.map((item) => item.locator)).toEqual([
-      `${match.conversation.id}#${match.message.id}`,
-    ]);
+    // The index is authoritative for content matching — an empty candidate
+    // set is an empty result, not a trigger for a table-scan fallback.
+    expect(result.evidence).toEqual([]);
   });
 });