@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/__tests__/subagent-tool-gate-mode.test.ts

@@ -15,7 +15,7 @@
  *   gating the resolved inner tool name.
  */
 
-import { describe, expect, mock, test } from "bun:test";
+import { afterEach, describe, expect, mock, test } from "bun:test";
 
 import type { SkillProjectionCache } from "../daemon/conversation-skill-tools.js";
 import type { SurfaceData, SurfaceType } from "../daemon/message-protocol.js";
@@ -101,6 +101,11 @@ import {
   type SkillProjectionContext,
   type ToolSetupContext,
 } from "../daemon/conversation-tool-setup.js";
+import {
+  __clearRegistryForTesting,
+  registerPluginTools,
+} from "../tools/registry.js";
+import type { Tool } from "../tools/types.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -474,3 +479,75 @@ describe("createToolExecutor — execution-layer allowlist gate", () => {
     expect(calls).toHaveLength(1);
   });
 });
+
+// ---------------------------------------------------------------------------
+// Executor — per-chat plugin scope guard on the skill_execute dispatch path
+// ---------------------------------------------------------------------------
+
+describe("createToolExecutor — per-chat plugin scope (skill_execute dispatch)", () => {
+  function pluginTool(name: string): Tool {
+    return {
+      name,
+      description: name,
+      input_schema: { type: "object" },
+    } as unknown as Tool;
+  }
+
+  afterEach(() => {
+    __clearRegistryForTesting();
+  });
+
+  test("rejects a skill_execute inner tool owned by a plugin outside the effective set; executor never invoked", async () => {
+    registerPluginTools("p", [pluginTool("p_tool")]);
+    const { executor, calls } = makeCapturingExecutor();
+    // Scope excludes plugin "p" (only "other" + first-party defaults).
+    const toolFn = makeToolFn(
+      executor,
+      makeSetupCtx({ enabledPlugins: ["other"] }),
+    );
+
+    const result = await toolFn("skill_execute", {
+      tool: "p_tool",
+      input: {},
+    });
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain(
+      'Tool "p_tool" belongs to a plugin that is not enabled',
+    );
+    expect(calls).toHaveLength(0);
+  });
+
+  test("allows a skill_execute inner tool whose plugin is in the effective set", async () => {
+    registerPluginTools("p", [pluginTool("p_tool")]);
+    const { executor, calls } = makeCapturingExecutor();
+    const toolFn = makeToolFn(
+      executor,
+      makeSetupCtx({ enabledPlugins: ["p"] }),
+    );
+
+    const result = await toolFn("skill_execute", {
+      tool: "p_tool",
+      input: {},
+    });
+
+    expect(result).toEqual({ content: "ok", isError: false });
+    expect(calls).toHaveLength(1);
+    expect(calls[0]!.name).toBe("p_tool");
+  });
+
+  test("null scope (no per-chat restriction) does not gate plugin tools", async () => {
+    registerPluginTools("p", [pluginTool("p_tool")]);
+    const { executor, calls } = makeCapturingExecutor();
+    // enabledPlugins absent → getEffectiveEnabledPluginSet returns null.
+    const toolFn = makeToolFn(executor, makeSetupCtx());
+
+    const result = await toolFn("skill_execute", {
+      tool: "p_tool",
+      input: {},
+    });
+
+    expect(result).toEqual({ content: "ok", isError: false });
+    expect(calls).toHaveLength(1);
+  });
+});

package/src/__tests__/system-prompt.test.ts

@@ -312,6 +312,7 @@ describe("buildSystemPrompt", () => {
     expect(result).not.toContain("## External Communications Identity");
     expect(result).not.toContain("## In-Chat Configuration");
     expect(result).not.toContain("## Historical Mentions Are Read-Only");
+    expect(result).not.toContain("## Communication");
   });
 
   test("does not include removed domain routing sections", () => {
@@ -457,9 +458,10 @@ describe("buildSystemPrompt", () => {
       expect(result).not.toContain("{{userSlug}}");
     });
 
-    test("substitutes the unmodified bundled BOOTSTRAP.md template", () => {
-      // Copy the real bundled BOOTSTRAP.md into the test workspace so we
-      // verify substitution against the actual template the daemon ships.
+    test("leaves no unresolved placeholders in the bundled BOOTSTRAP.md template", () => {
+      // Render the real bundled BOOTSTRAP.md the daemon ships and verify
+      // substitution leaves no leftover {{userSlug}} placeholder, whether or
+      // not the current template happens to reference it.
       mockPersona.userSlug = "alice";
       const bundled = readFileSync(
         join(import.meta.dirname, "..", "prompts", "templates", "BOOTSTRAP.md"),
@@ -467,7 +469,6 @@ describe("buildSystemPrompt", () => {
       );
       writeFileSync(join(TEST_DIR, "BOOTSTRAP.md"), bundled);
       const result = buildSystemPrompt();
-      expect(result).toContain("users/alice.md");
       expect(result).not.toContain("{{userSlug}}");
     });
   });
@@ -664,26 +665,6 @@ describe("buildSystemPrompt", () => {
       expect(result).toContain("Batch independent tool calls");
     });
 
-    test("bundled communication section renders and sorts before the parallel-tool-calls block", () => {
-      // `01-communication` sorts ahead of `01-parallel-tool-calls`, so the
-      // communication guidance leads the operational sections.
-      const result = buildSystemPrompt();
-      expect(result).toContain("## Communication");
-      // The core rule: deliberation belongs in private thinking, not text.
-      expect(result).toContain(
-        "in your private thinking — never in user-facing text",
-      );
-      // Closes by deferring to the user's established communication preferences.
-      expect(result).toContain(
-        "Always prioritize communication preferences that you've established",
-      );
-      const communicationIdx = result.indexOf("## Communication");
-      const parallelIdx = result.indexOf("<use_parallel_tool_calls>");
-      expect(communicationIdx).toBeGreaterThan(-1);
-      expect(parallelIdx).toBeGreaterThan(-1);
-      expect(communicationIdx).toBeLessThan(parallelIdx);
-    });
-
     test("workspace prefix with frontmatter renders body at the very top", () => {
       mkdirSync(SYSTEM_PROMPTS_DIR, { recursive: true });
       writeFileSync(
@@ -887,7 +868,9 @@ describe("buildSystemPrompt", () => {
         // after the stable instruction sections
         const boundaryIdx = result.indexOf(SYSTEM_PROMPT_CACHE_BOUNDARY);
         expect(boundaryIdx).toBeGreaterThan(-1);
-        expect(result.indexOf("## Communication")).toBeLessThan(boundaryIdx);
+        expect(result.indexOf("<use_parallel_tool_calls>")).toBeLessThan(
+          boundaryIdx,
+        );
         expect(result.indexOf("# Voice Profile")).toBeGreaterThan(boundaryIdx);
       });
 
@@ -967,7 +950,9 @@ describe("buildSystemPrompt", () => {
         expect(result.indexOf("Custom head section.")).toBeLessThan(
           boundaryIdx,
         );
-        expect(result.indexOf("## Communication")).toBeGreaterThan(boundaryIdx);
+        expect(result.indexOf("<use_parallel_tool_calls>")).toBeGreaterThan(
+          boundaryIdx,
+        );
 
         // AND the bundled default declaration on 11-channel-persona is
         // ignored — no second marker
@@ -1068,91 +1053,6 @@ describe("buildSystemPrompt", () => {
       });
     });
 
-    describe("access-preference section (slot 05)", () => {
-      const ACCESS_FILE = join(SYSTEM_PROMPTS_DIR, "05-access-preference.md");
-      // Mirrors the bundled `templates/system/05-access-preference.md` — both
-      // variants live in the markdown body and the renderer picks one via
-      // mustache-style `{{#hasNoClient}}` / `{{^hasNoClient}}` conditionals.
-      const TEMPLATE_BODY = [
-        "## External Service Access",
-        "",
-        "{{#hasNoClient}}",
-        "Priority: (1) sandbox `bash` — install tools yourself; (2) browser automation as last resort (no API, visual interaction, or OAuth consent).",
-        "{{/hasNoClient}}",
-        "{{^hasNoClient}}",
-        "Priority: (1) sandbox `bash` - install tools yourself, only fall back to host when you need local files/auth; (2) `host_bash` with CLIs (gh, aws, etc.) using --json flags; (3) browser automation as last resort (no API, visual interaction, or OAuth consent).",
-        "{{/hasNoClient}}",
-        "",
-      ].join("\n");
-
-      test("with-client (default) renders the three-tier priority list", () => {
-        mkdirSync(SYSTEM_PROMPTS_DIR, { recursive: true });
-        writeFileSync(ACCESS_FILE, TEMPLATE_BODY);
-        const result = buildSystemPrompt();
-        expect(result).toContain("## External Service Access");
-        expect(result).toContain("`host_bash` with CLIs");
-        expect(result).toContain("browser automation as last resort");
-        // The no-client body (em-dash separator after sandbox `bash`) must
-        // not leak when the with-client variant is active.
-        expect(result).not.toContain("install tools yourself; (2) browser");
-        expect(result).toContain("## External Service Access");
-      });
-
-      test("hasNoClient=true renders the two-tier (no host_bash) priority list", () => {
-        mkdirSync(SYSTEM_PROMPTS_DIR, { recursive: true });
-        writeFileSync(ACCESS_FILE, TEMPLATE_BODY);
-        const result = buildSystemPrompt({ hasNoClient: true });
-        expect(result).toContain("## External Service Access");
-        expect(result).toContain("browser automation as last resort");
-        // The host_bash tier must be absent in the no-client variant.
-        expect(result).not.toContain("`host_bash` with CLIs");
-        // The no-client body uses an em-dash + semicolon separator after
-        // sandbox `bash`; the with-client body uses a comma — guard against
-        // the wrong variant leaking through.
-        expect(result).toContain("install tools yourself; (2) browser");
-        expect(result).not.toContain(
-          "only fall back to host when you need local files/auth",
-        );
-      });
-
-      test("standalone tag lines do not bleed extra blank lines into output", () => {
-        mkdirSync(SYSTEM_PROMPTS_DIR, { recursive: true });
-        writeFileSync(ACCESS_FILE, TEMPLATE_BODY);
-        const result = buildSystemPrompt();
-        // The heading and the active variant body should sit on adjacent
-        // lines separated by exactly one blank line — no triple-newline
-        // artifacts from the section markers.
-        expect(result).toMatch(
-          /## External Service Access\n\nPriority: \(1\) sandbox `bash` -/,
-        );
-      });
-
-      test("bundled access-preference default renders when no workspace override", () => {
-        // Bundled `05-access-preference.md` carries both with-client and
-        // no-client variants inline behind mustache section conditionals,
-        // so the default body renders without any workspace file present.
-        mkdirSync(SYSTEM_PROMPTS_DIR, { recursive: true });
-        const result = buildSystemPrompt();
-        expect(result).toContain("## External Service Access");
-        expect(result).toContain("`host_bash` with CLIs");
-      });
-
-      test("renders after the attachment section to preserve original order", () => {
-        mkdirSync(SYSTEM_PROMPTS_DIR, { recursive: true });
-        writeFileSync(
-          join(SYSTEM_PROMPTS_DIR, "04-attachment.md"),
-          "## Sending Files to the User\n\nbody.\n",
-        );
-        writeFileSync(ACCESS_FILE, TEMPLATE_BODY);
-        const result = buildSystemPrompt();
-        const attachmentIdx = result.indexOf("## Sending Files to the User");
-        const accessIdx = result.indexOf("## External Service Access");
-        expect(attachmentIdx).toBeGreaterThan(-1);
-        expect(accessIdx).toBeGreaterThan(-1);
-        expect(attachmentIdx).toBeLessThan(accessIdx);
-      });
-    });
-
     describe("mustache section interpolation", () => {
       // Reuse slot 00 (prefix) — its default-on `enabled` predicate is
       // already covered by other tests; here we only care about body
@@ -1329,17 +1229,16 @@ describe("buildSystemPrompt", () => {
         expect(result).toContain("`assistant credentials prompt`");
       });
 
-      test("renders after the access-preference section to preserve original order", () => {
-        // Static-block order from the pre-registry inline build was
-        // access-preference → credential-security.  The numeric prefix on
-        // the registry id (`06-` > `05-`) preserves that order.
+      test("renders after the attachment section to preserve original order", () => {
+        // Registry ids sort by numeric prefix, so `06-credential-security`
+        // renders after the preceding static section `04-attachment`.
         mkdirSync(SYSTEM_PROMPTS_DIR, { recursive: true });
         const result = buildSystemPrompt();
-        const accessIdx = result.indexOf("## External Service Access");
+        const attachmentIdx = result.indexOf("## Sending Files to the User");
         const credentialIdx = result.indexOf("## Credential Security");
-        expect(accessIdx).toBeGreaterThan(-1);
+        expect(attachmentIdx).toBeGreaterThan(-1);
         expect(credentialIdx).toBeGreaterThan(-1);
-        expect(accessIdx).toBeLessThan(credentialIdx);
+        expect(attachmentIdx).toBeLessThan(credentialIdx);
       });
     });
 

package/src/__tests__/task-scheduler.test.ts

@@ -85,6 +85,23 @@ mock.module("../tools/registry.js", () => ({
   areCoreToolsInitialized: () => coreToolsReady,
 }));
 
+// The scheduler dispatches task/reuse-path messages through `processMessage`;
+// route them to a per-test delegate so tests can capture those calls. The
+// delegate receives the daemon-shaped options (trustContext, taskRunId, …)
+// that the scheduler maps from the schedule's trustClass.
+let processMessageImpl: (
+  conversationId: string,
+  message: string,
+  options?: unknown,
+) => Promise<unknown> = async () => {};
+mock.module("../daemon/process-message.js", () => ({
+  processMessage: (
+    conversationId: string,
+    message: string,
+    options?: unknown,
+  ) => processMessageImpl(conversationId, message, options),
+}));
+
 import { getDb } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
 import { recordUsageEvent } from "../persistence/llm-usage-store.js";
@@ -198,6 +215,7 @@ describe("scheduler run_task detection", () => {
     db.run("DELETE FROM conversations");
     onRunBackgroundJobCall = null;
     emitNotificationCalls.length = 0;
+    processMessageImpl = async () => {};
   });
 
   test("run_task:<id> messages trigger runTask instead of processMessage", async () => {
@@ -219,17 +237,20 @@ describe("scheduler run_task detection", () => {
     const directCalls: Array<{
       conversationId: string;
       message: string;
-      options?: { trustClass?: string; taskRunId?: string };
+      options?: {
+        trustContext?: { sourceChannel?: string; trustClass?: string };
+        taskRunId?: string;
+      };
     }> = [];
-    const processMessage = async (
-      conversationId: string,
-      message: string,
-      options?: { trustClass?: string; taskRunId?: string },
-    ) => {
-      directCalls.push({ conversationId, message, options });
+    processMessageImpl = async (conversationId, message, options) => {
+      directCalls.push({
+        conversationId,
+        message,
+        options: options as (typeof directCalls)[number]["options"],
+      });
     };
 
-    const scheduler = startScheduler(processMessage, () => {});
+    const scheduler = startScheduler();
 
     // Wait for the initial tick to complete
     await new Promise((resolve) => setTimeout(resolve, 500));
@@ -246,7 +267,7 @@ describe("scheduler run_task detection", () => {
     expect(runTaskCalls.length).toBe(1);
     // The scheduler should NOT pass the raw run_task: message to processMessage
     expect(rawCalls.length).toBe(0);
-    expect(runTaskCalls[0].options?.trustClass).toBe("guardian");
+    expect(runTaskCalls[0].options?.trustContext?.trustClass).toBe("guardian");
     expect(typeof runTaskCalls[0].options?.taskRunId).toBe("string");
   });
 
@@ -270,10 +291,7 @@ describe("scheduler run_task detection", () => {
       runnerCalls.push(info);
     };
 
-    const scheduler = startScheduler(
-      async () => {},
-      () => {},
-    );
+    const scheduler = startScheduler();
 
     await new Promise((resolve) => setTimeout(resolve, 500));
     scheduler.stop();
@@ -300,12 +318,7 @@ describe("scheduler run_task detection", () => {
 
     forceScheduleDue(schedule.id);
 
-    const processMessage = async (
-      _conversationId: string,
-      _message: string,
-    ) => {};
-
-    const scheduler = startScheduler(processMessage, () => {});
+    const scheduler = startScheduler();
 
     await new Promise((resolve) => setTimeout(resolve, 500));
     scheduler.stop();
@@ -350,32 +363,30 @@ describe("scheduler run_task detection", () => {
     let usageEventCreatedAt: number | null = null;
     let runsDuringProcessing: ReturnType<typeof getScheduleRuns> = [];
 
-    const result = await runScheduleDueWorkOnce(
-      async (conversationId) => {
-        processingConversationId = conversationId;
-        runsDuringProcessing = getScheduleRuns(schedule.id);
-        const event = recordUsageEvent(
-          {
-            conversationId,
-            runId: null,
-            requestId: "req-scheduled-task-usage",
-            actor: "main_agent",
-            callSite: "mainAgent",
-            inferenceProfile: "balanced",
-            provider: "anthropic",
-            model: "claude-sonnet-4-20250514",
-            inputTokens: 100,
-            outputTokens: 50,
-            cacheCreationInputTokens: 0,
-            cacheReadInputTokens: 0,
-            rawUsage: null,
-          },
-          { estimatedCostUsd: 0.25, pricingStatus: "priced" },
-        );
-        usageEventCreatedAt = event.createdAt;
-      },
-      () => {},
-    );
+    processMessageImpl = async (conversationId) => {
+      processingConversationId = conversationId;
+      runsDuringProcessing = getScheduleRuns(schedule.id);
+      const event = recordUsageEvent(
+        {
+          conversationId,
+          runId: null,
+          requestId: "req-scheduled-task-usage",
+          actor: "main_agent",
+          callSite: "mainAgent",
+          inferenceProfile: "balanced",
+          provider: "anthropic",
+          model: "claude-sonnet-4-20250514",
+          inputTokens: 100,
+          outputTokens: 50,
+          cacheCreationInputTokens: 0,
+          cacheReadInputTokens: 0,
+          rawUsage: null,
+        },
+        { estimatedCostUsd: 0.25, pricingStatus: "priced" },
+      );
+      usageEventCreatedAt = event.createdAt;
+    };
+    const result = await runScheduleDueWorkOnce();
     const to = Date.now() + 1000;
 
     expect(result.completed).toBe(1);
@@ -447,10 +458,7 @@ describe("scheduler run_task detection", () => {
       usageEventCreatedAt = event.createdAt;
     };
 
-    const result = await runScheduleDueWorkOnce(
-      async () => {},
-      () => {},
-    );
+    const result = await runScheduleDueWorkOnce();
     const to = Date.now() + 1000;
 
     expect(result.completed).toBe(1);
@@ -500,6 +508,7 @@ describe("scheduler workflow mode", () => {
       return { runId: "wf-run-1" };
     };
     coreToolsReady = true;
+    processMessageImpl = async () => {};
   });
 
   test("a due workflow-mode job triggers the run manager with name/args", async () => {
@@ -515,10 +524,7 @@ describe("scheduler workflow mode", () => {
     });
     forceScheduleDue(schedule.id);
 
-    const result = await runScheduleDueWorkOnce(
-      async () => {},
-      () => {},
-    );
+    const result = await runScheduleDueWorkOnce();
 
     expect(result.completed).toBe(1);
     expect(result.failed).toBe(0);
@@ -551,10 +557,7 @@ describe("scheduler workflow mode", () => {
     });
     forceScheduleDue(schedule.id);
 
-    await runScheduleDueWorkOnce(
-      async () => {},
-      () => {},
-    );
+    await runScheduleDueWorkOnce();
 
     expect(workflowStartCalls).toHaveLength(1);
     expect(workflowStartCalls[0]).toMatchObject({
@@ -578,10 +581,7 @@ describe("scheduler workflow mode", () => {
     });
     forceScheduleDue(schedule.id);
 
-    await runScheduleDueWorkOnce(
-      async () => {},
-      () => {},
-    );
+    await runScheduleDueWorkOnce();
 
     expect(workflowStartCalls).toHaveLength(1);
     expect(workflowStartCalls[0]).toMatchObject({
@@ -604,10 +604,7 @@ describe("scheduler workflow mode", () => {
     });
     forceScheduleDue(schedule.id);
 
-    await runScheduleDueWorkOnce(
-      async () => {},
-      () => {},
-    );
+    await runScheduleDueWorkOnce();
 
     expect(workflowStartCalls).toHaveLength(1);
     expect(workflowStartCalls[0]).toMatchObject({
@@ -628,10 +625,7 @@ describe("scheduler workflow mode", () => {
     });
     forceScheduleDue(schedule.id);
 
-    await runScheduleDueWorkOnce(
-      async () => {},
-      () => {},
-    );
+    await runScheduleDueWorkOnce();
 
     expect(workflowStartCalls[0]).toMatchObject({
       conversationId: "conv-wake",
@@ -649,10 +643,7 @@ describe("scheduler workflow mode", () => {
     });
     forceScheduleDue(schedule.id);
 
-    await runScheduleDueWorkOnce(
-      async () => {},
-      () => {},
-    );
+    await runScheduleDueWorkOnce();
 
     expect(workflowStartCalls).toHaveLength(1);
     expect(workflowStartCalls[0].args).toEqual({});
@@ -672,10 +663,7 @@ describe("scheduler workflow mode", () => {
     });
     forceScheduleDue(schedule.id);
 
-    const result = await runScheduleDueWorkOnce(
-      async () => {},
-      () => {},
-    );
+    const result = await runScheduleDueWorkOnce();
 
     expect(result.failed).toBe(1);
     const runs = getScheduleRuns(schedule.id);
@@ -693,10 +681,7 @@ describe("scheduler workflow mode", () => {
     });
     forceScheduleDue(schedule.id);
 
-    const result = await runScheduleDueWorkOnce(
-      async () => {},
-      () => {},
-    );
+    const result = await runScheduleDueWorkOnce();
 
     expect(result.skipped).toBe(1);
     expect(workflowStartCalls).toHaveLength(0);
@@ -716,10 +701,7 @@ describe("scheduler workflow mode", () => {
 
     // Tools not yet registered: the run must be deferred, not launched with an
     // empty baseline. No run-manager start, no run record, marked skipped.
-    const result = await runScheduleDueWorkOnce(
-      async () => {},
-      () => {},
-    );
+    const result = await runScheduleDueWorkOnce();
     expect(workflowStartCalls).toHaveLength(0);
     expect(result.skipped).toBe(1);
     expect(getScheduleRuns(schedule.id)).toHaveLength(0);
@@ -727,10 +709,7 @@ describe("scheduler workflow mode", () => {
     // Re-armed to due (not consumed): once tools are ready, a later tick fires
     // it with the full baseline.
     coreToolsReady = true;
-    await runScheduleDueWorkOnce(
-      async () => {},
-      () => {},
-    );
+    await runScheduleDueWorkOnce();
     expect(workflowStartCalls).toHaveLength(1);
     expect(workflowStartCalls[0]).toMatchObject({ name: "triage-inbox" });
   });