@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.10.4",
+  "version": "0.10.5-dev.202607022329.d89bf2f",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -50,7 +50,6 @@
     "@vellumai/gateway-client": "file:../packages/gateway-client",
     "@vellumai/ipc-server-utils": "file:../packages/ipc-server-utils",
     "@vellumai/service-contracts": "file:../packages/service-contracts",
-    "@vellumai/skill-host-contracts": "file:../packages/skill-host-contracts",
     "@vellumai/slack-text": "file:../packages/slack-text",
     "@vellumai/twilio-client": "file:../packages/twilio-client",
     "commander": "13.1.0",
@@ -67,7 +66,6 @@
     "pino": "9.14.0",
     "pino-pretty": "13.1.3",
     "playwright": "1.58.2",
-    "postgres": "3.4.8",
     "quickjs-emscripten": "0.32.0",
     "re2js": "2.8.3",
     "remark-gfm": "4.0.1",
@@ -94,7 +92,6 @@
     "@vellumai/environments",
     "@vellumai/gateway-client",
     "@vellumai/ipc-server-utils",
-    "@vellumai/skill-host-contracts",
     "@vellumai/slack-text",
     "@vellumai/twilio-client"
   ],

package/scripts/test.sh

@@ -205,22 +205,44 @@ printf '%s\n' "${test_files[@]}" | xargs -P "${WORKERS}" -I {} bash -c '
     fi
   }
 
+  # Bun test output evidence: "(fail)" lines mark assertion failures, and the
+  # end-of-run summary ("Ran X tests across Y files") marks a completed run.
+  has_failed_assertion() {
+    grep -q "^(fail)" "${out_file}" 2>/dev/null
+  }
+  reached_end_of_run() {
+    grep -qE "^Ran [0-9]+ tests? across" "${out_file}" 2>/dev/null
+  }
+
   start_ms=$(perl -MTime::HiRes=time -e "printf \"%d\", time*1000")
 
   run_bun_test
   exit_code=$?
 
-  # Retry once on a transient bun loader/runtime crash. Bun occasionally aborts
-  # a worker before its tests run — e.g. "# Unhandled error between tests" with
-  # "error: ENOENT reading <corrupted path>" — failing the whole job even though
-  # the file is green on a clean process. Such a crash truncates the run before
-  # any assertion executes, so it prints no "(fail)" line; genuine assertion
-  # failures do, and are reported immediately without a retry (fast feedback, no
-  # masking of intermittent real failures). Timeouts (124/137) are handled by the
-  # hang branch below, not here.
-  if [[ ${exit_code} -ne 0 && ${exit_code} -ne 124 && ${exit_code} -ne 137 ]] \
-     && ! grep -q "^(fail)" "${out_file}" 2>/dev/null; then
-    echo "  ↻ ${base} (transient crash, exit ${exit_code} — retrying once)"
+  # Retry once when a failing run produced no conclusive test evidence:
+  #   - transient loader/runtime crash (non-zero, non-timeout exit): bun
+  #     occasionally aborts a worker before its tests run — e.g. "# Unhandled
+  #     error between tests" with "error: ENOENT reading <corrupted path>"
+  #   - transient hang (timeout kill before the end-of-run summary): bun
+  #     occasionally deadlocks while loading a test file, so the timeout reaps
+  #     a process that never completed the run
+  # Neither leaves a "(fail)" line; genuine assertion failures print one and
+  # are reported immediately without a retry (fast feedback, no masking of
+  # intermittent real failures). A timed-out run that reached the end-of-run
+  # summary is the passed-but-hung-at-exit case classified below — no retry
+  # needed.
+  retry_reason=""
+  if [[ ${exit_code} -ne 0 ]] && ! has_failed_assertion; then
+    if [[ -n "${timeout_cmd}" && ( ${exit_code} -eq 124 || ${exit_code} -eq 137 ) ]]; then
+      if ! reached_end_of_run; then
+        retry_reason="hung after ${per_test_timeout}s without completing"
+      fi
+    else
+      retry_reason="transient crash, exit ${exit_code}"
+    fi
+  fi
+  if [[ -n "${retry_reason}" ]]; then
+    echo "  ↻ ${base} (${retry_reason} — retrying once)"
     run_bun_test
     exit_code=$?
   fi
@@ -239,10 +261,10 @@ printf '%s\n' "${test_files[@]}" | xargs -P "${WORKERS}" -I {} bash -c '
     # "Ran X tests across Y files" when the run completes. Both conditions
     # must hold: no failures AND the end-of-run summary present. Without
     # the summary, the process was killed mid-run before finishing all tests.
-    if grep -q "^(fail)" "${out_file}" 2>/dev/null; then
+    if has_failed_assertion; then
       echo "${test_file}" >> "${results_dir}/failures"
       echo "  ✗ ${base} (killed after ${per_test_timeout}s — tests failed and process hung)"
-    elif grep -qE "^Ran [0-9]+ tests? across" "${out_file}" 2>/dev/null; then
+    elif reached_end_of_run; then
       echo "  ⚠ ${base} (tests passed but process hung after ${per_test_timeout}s — likely open handles)"
     else
       echo "${test_file}" >> "${results_dir}/failures"

package/src/__tests__/access-request-seed-content-blocks.test.ts

@@ -153,11 +153,67 @@ describe("buildAccessRequestSeedContentBlocks", () => {
     );
   });
 
-  test("surface block includes approve/reject actions when requestId present", () => {
-    const surface = surfaceOf(buildAccessRequestSeedContentBlocks(basePayload));
+  test("surface block renders introduction actions for a workspace member (no code option)", () => {
+    // Explicit positive signals: users.info resolved a regular member.
+    const surface = surfaceOf(
+      buildAccessRequestSeedContentBlocks({
+        ...basePayload,
+        isStranger: false,
+        isRestricted: false,
+      }),
+    );
     expect(surface.actions).toEqual([
-      { id: "apr:req-123:approve_once", label: "Approve", style: "primary" },
-      { id: "apr:req-123:reject", label: "Reject", style: "destructive" },
+      { id: "apr:req-123:trust", label: "Trust", style: "primary" },
+      {
+        id: "apr:req-123:leave_unverified",
+        label: "Leave unverified",
+        style: "secondary",
+      },
+      { id: "apr:req-123:block", label: "Block", style: "destructive" },
+    ]);
+  });
+
+  test("surface block leads with the handshake for an external Slack user", () => {
+    const surface = surfaceOf(
+      buildAccessRequestSeedContentBlocks({ ...basePayload, isStranger: true }),
+    );
+    // Unknown signals (users.info failure) render the same handshake-led
+    // shape — absent platform vouching must never yield one-tap Trust.
+    const unknownSignals = surfaceOf(
+      buildAccessRequestSeedContentBlocks(basePayload),
+    );
+    expect(unknownSignals.actions?.map((a) => a.id)).toEqual(
+      surface.actions?.map((a) => a.id) ?? [],
+    );
+    expect(surface.actions).toEqual([
+      {
+        id: "apr:req-123:verify_code",
+        label: "Verify with a code",
+        style: "primary",
+      },
+      { id: "apr:req-123:trust", label: "Trust anyway", style: "secondary" },
+      {
+        id: "apr:req-123:leave_unverified",
+        label: "Leave unverified",
+        style: "secondary",
+      },
+      { id: "apr:req-123:block", label: "Block", style: "destructive" },
+    ]);
+  });
+
+  test("surface block never offers the code option for a bot", () => {
+    const surface = surfaceOf(
+      buildAccessRequestSeedContentBlocks({
+        ...basePayload,
+        isBot: true,
+        isStranger: true,
+      }),
+    );
+    const ids = (surface.actions ?? []).map((a) => a.id);
+    expect(ids).toEqual([
+      "apr:req-123:trust",
+      "apr:req-123:leave_unverified",
+      "apr:req-123:block",
     ]);
   });
 

package/src/__tests__/acp-session.test.ts

@@ -185,7 +185,6 @@ describe("VellumAcpClientHandler", () => {
       expect(sent).toHaveLength(0);
       expect(handler.pendingRequestIds.size).toBe(0);
     });
-
   });
 });
 
@@ -264,6 +263,8 @@ describe("AcpSessionManager", () => {
         initialize: mock(() => Promise.resolve()),
         createSession: mock(() => Promise.resolve("proto-session")),
         cancel: mock(() => Promise.resolve()),
+        markStderr: () => 0,
+        stderrSince: () => "",
       };
       const fakeHandler = new VellumAcpClientHandler(
         "test-session",
@@ -324,6 +325,8 @@ describe("AcpSessionManager", () => {
       const fakeProcess = {
         prompt: () => promptPromise,
         kill: mock(() => {}),
+        markStderr: () => 0,
+        stderrSince: () => "",
       };
       const fakeHandler = new VellumAcpClientHandler(
         "test-session-2",

package/src/__tests__/actor-trust-resolver-address-fallback.test.ts

@@ -85,8 +85,6 @@ function makeContact(
     displayName: "Patrick Test",
     notes: null,
     role,
-    lastInteraction: null,
-    interactionCount: 0,
     contactType: "human" as const,
     userFile: null,
     createdAt: 0,
@@ -99,10 +97,6 @@ function makeContact(
         address: PHONE,
         externalChatId: null,
         isPrimary: true,
-        inviteId: null,
-        lastSeenAt: null,
-        interactionCount: 0,
-        lastInteraction: null,
         createdAt: 0,
         updatedAt: 0,
       },

package/src/__tests__/add-message-preassigned-id.test.ts

@@ -0,0 +1,56 @@
+import { randomUUID } from "node:crypto";
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import { addMessage, getMessages } from "../persistence/conversation-crud.js";
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+import { conversations } from "../persistence/schema.js";
+
+await initializeDb();
+
+function ensureConversation(id: string): void {
+  const db = getDb();
+  const now = Date.now();
+  db.insert(conversations)
+    .values({
+      id,
+      title: "test",
+      createdAt: now,
+      updatedAt: now,
+      lastMessageAt: now,
+    })
+    .onConflictDoNothing()
+    .run();
+}
+
+describe("addMessage pre-assigned id", () => {
+  beforeEach(() => {
+    ensureConversation("conv-preassigned-id");
+  });
+
+  test("uses the provided id as the persisted row id", async () => {
+    const customId = randomUUID();
+    const result = await addMessage("conv-preassigned-id", "user", "hello", {
+      id: customId,
+    });
+
+    expect(result.id).toBe(customId);
+    expect(result.deduplicated).toBe(false);
+
+    const msgs = getMessages("conv-preassigned-id");
+    const found = msgs.find((m) => m.id === customId);
+    expect(found).toBeDefined();
+    expect(found?.content).toBe("hello");
+  });
+
+  test("generates a uuid when no id is provided", async () => {
+    const result = await addMessage("conv-preassigned-id", "user", "world");
+
+    expect(result.id).toBeTruthy();
+    expect(result.deduplicated).toBe(false);
+    // Should be a UUID-like string (36 chars with hyphens)
+    expect(result.id).toMatch(
+      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,
+    );
+  });
+});

package/src/__tests__/agent-loop-set-system-prompt.test.ts

@@ -0,0 +1,139 @@
+/**
+ * Tests for `AgentLoop.setSystemPrompt` — the seam that lets a conversation
+ * update the loop's system prompt between turns.
+ *
+ * The loop snapshots `this.systemPrompt` once per `run()`, so a conversation
+ * that resolves its persona context after the loop is constructed (a voice
+ * call binds the caller's trust only after `getOrCreateConversation`) must be
+ * able to push the re-resolved prompt in before the next turn. These tests
+ * drive the REAL loop against a recording provider and assert the prompt the
+ * provider receives, with a pass-through `pre-model-call` hook so the loop's
+ * own prompt — not a hook mutation — is what reaches the wire.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// Standard logger stub (same shape as the rest of the suite).
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
+}));
+
+// Pass-through plugin pipeline: the `pre-model-call` hook returns its context
+// unchanged, so `providerOptions.systemPrompt` stays exactly the prompt the
+// loop snapshotted for the run.
+mock.module("../plugins/pipeline.js", () => ({
+  runHook: async (_hook: unknown, ctx: unknown): Promise<unknown> => ctx,
+}));
+
+let mockLlmConfig: Record<string, unknown> = {};
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({ llm: mockLlmConfig }),
+}));
+
+import { AgentLoop } from "../agent/loop.js";
+import { LLMSchema } from "../config/schemas/llm.js";
+import type { TrustContext } from "../daemon/trust-context.js";
+import type {
+  Message,
+  Provider,
+  ProviderResponse,
+  SendMessageOptions,
+} from "../providers/types.js";
+
+const userMessage: Message = {
+  role: "user",
+  content: [{ type: "text", text: "hi" }],
+};
+
+const trust: TrustContext = {
+  sourceChannel: "vellum",
+  trustClass: "guardian",
+};
+
+/**
+ * Provider that records the system prompt of every send and ends the turn
+ * after one call.
+ */
+function makeRecordingProvider(): {
+  provider: Provider;
+  capturedSystemPrompts: () => (string | undefined)[];
+} {
+  const captured: (string | undefined)[] = [];
+  const provider: Provider = {
+    name: "anthropic",
+    async sendMessage(
+      _messages: Message[],
+      options?: SendMessageOptions,
+    ): Promise<ProviderResponse> {
+      captured.push(options?.systemPrompt);
+      return {
+        content: [{ type: "text", text: "done" }],
+        model: "mock-model",
+        usage: { inputTokens: 1, outputTokens: 1 },
+        stopReason: "end_turn",
+      };
+    },
+  };
+  return { provider, capturedSystemPrompts: () => captured };
+}
+
+function makeLoop(provider: Provider, systemPrompt: string): AgentLoop {
+  return new AgentLoop({
+    provider,
+    systemPrompt,
+    config: {},
+    conversationId: "test-conv",
+  });
+}
+
+async function runOnce(loop: AgentLoop): Promise<void> {
+  await loop.run({
+    requestId: "test-request",
+    messages: [userMessage],
+    onEvent: () => {},
+    trust,
+    callSite: "mainAgent",
+  });
+}
+
+beforeEach(() => {
+  mockLlmConfig = LLMSchema.parse({
+    default: { provider: "anthropic", model: "mock-model" },
+  }) as Record<string, unknown>;
+});
+
+describe("AgentLoop.setSystemPrompt", () => {
+  test("a prompt set before the run is what the provider receives", async () => {
+    const { provider, capturedSystemPrompts } = makeRecordingProvider();
+    const loop = makeLoop(provider, "CONSTRUCTION-PERSONA");
+
+    loop.setSystemPrompt("LATE-BOUND-PERSONA");
+    await runOnce(loop);
+
+    expect(capturedSystemPrompts()).toEqual(["LATE-BOUND-PERSONA"]);
+  });
+
+  test("without a push, the construction-time prompt is used", async () => {
+    const { provider, capturedSystemPrompts } = makeRecordingProvider();
+    const loop = makeLoop(provider, "CONSTRUCTION-PERSONA");
+
+    await runOnce(loop);
+
+    expect(capturedSystemPrompts()).toEqual(["CONSTRUCTION-PERSONA"]);
+  });
+
+  test("a prompt pushed between turns takes effect on the next run", async () => {
+    const { provider, capturedSystemPrompts } = makeRecordingProvider();
+    const loop = makeLoop(provider, "FIRST-PERSONA");
+
+    await runOnce(loop);
+    loop.setSystemPrompt("SECOND-PERSONA");
+    await runOnce(loop);
+
+    expect(capturedSystemPrompts()).toEqual([
+      "FIRST-PERSONA",
+      "SECOND-PERSONA",
+    ]);
+  });
+});

package/src/__tests__/app-conversation-ids-backfill.test.ts

@@ -53,6 +53,7 @@ function insertMessage(
   const id = `msg-${Date.now()}-${Math.random().toString(36).slice(2)}`;
   const contentStr = JSON.stringify(content);
   rawRun(
+    "test:insertMessage",
     `INSERT INTO messages (id, conversation_id, role, content, created_at) VALUES (?, ?, ?, ?, ?)`,
     id,
     conversationId,
@@ -66,6 +67,7 @@ function insertMessage(
 function insertConversation(id: string): void {
   const now = Date.now();
   rawRun(
+    "test:insertConversation",
     `INSERT OR IGNORE INTO conversations (id, title, created_at, updated_at) VALUES (?, ?, ?, ?)`,
     id,
     "test",
@@ -205,6 +207,7 @@ describe("backfillAppConversationIds", () => {
     // Insert a message with invalid JSON that happens to match the LIKE filter
     const msgId = `msg-malformed-${Date.now()}`;
     rawRun(
+      "test:insertMalformedMessage",
       `INSERT INTO messages (id, conversation_id, role, content, created_at) VALUES (?, ?, ?, ?, ?)`,
       msgId,
       convId,

package/src/__tests__/app-source-watcher.test.ts

@@ -120,6 +120,17 @@ describe("AppSourceWatcher", () => {
     expect(onChangeSpy).not.toHaveBeenCalled();
   });
 
+  test(".git/ files are filtered out (apps-directory git repo churn)", async () => {
+    watcher.start(onChangeSpy);
+    capturedWatchCallback!("change", ".git/objects/ab/cdef");
+    capturedWatchCallback!("change", ".git/index");
+    capturedWatchCallback!("change", ".git/refs/heads/main");
+    capturedWatchCallback!("change", ".git/logs/HEAD");
+
+    await new Promise((r) => setTimeout(r, 600));
+    expect(onChangeSpy).not.toHaveBeenCalled();
+  });
+
   test("files directly in apps/ (no subdirectory) are filtered out", async () => {
     watcher.start(onChangeSpy);
     capturedWatchCallback!("change", "my-app.json");

package/src/__tests__/approval-interception-trust-gates.test.ts

@@ -24,8 +24,14 @@ mock.module("../daemon/conversation-registry.js", () => ({
   findConversation: (id: string) => _conversationMocks.get(id),
 }));
 
+// Anchored guardian principal, driven per-test to exercise the guardian
+// principal gate (undefined = anchor unresolvable).
+let _anchorPrincipalId: string | undefined;
+mock.module("../runtime/local-actor-identity.js", () => ({
+  findLocalGuardianPrincipalId: async () => _anchorPrincipalId,
+}));
+
 import type { Conversation } from "../daemon/conversation.js";
-import type { TrustContext } from "../daemon/trust-context.js";
 import { initializeDb } from "../persistence/db-init.js";
 import * as approvalMessageComposer from "../runtime/approval-message-composer.js";
 import * as gatewayClient from "../runtime/gateway-client.js";
@@ -76,6 +82,7 @@ describe("approval interception trust-class gates", () => {
 
   beforeEach(() => {
     pendingInteractions.clear();
+    _anchorPrincipalId = undefined;
     deliverSpy = spyOn(gatewayClient, "deliverChannelReply").mockResolvedValue({
       ok: true,
     });
@@ -105,7 +112,7 @@ describe("approval interception trust-class gates", () => {
         trustClass: "unknown",
         requesterExternalUserId: "intruder-user-1",
         guardianExternalUserId: "guardian-1",
-      } as TrustContext,
+      },
       assistantId: ASSISTANT_ID,
     });
 
@@ -117,6 +124,144 @@ describe("approval interception trust-class gates", () => {
     composeSpy.mockRestore();
   });
 
+  test("guardian apr: callback with a principal matching the anchor applies the decision", async () => {
+    _anchorPrincipalId = "guardian-principal-1";
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-apply-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-apply-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "guardian-user-1",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "guardian-user-1",
+        guardianExternalUserId: "guardian-user-1",
+        guardianPrincipalId: "guardian-principal-1",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("decision_applied");
+    expect(sessionMock).toHaveBeenCalled();
+  });
+
+  test("guardian apr: callback with a principal NOT matching the anchor is rejected before any decision", async () => {
+    _anchorPrincipalId = "the-real-guardian-principal";
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-mismatch-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-mismatch-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "stale-guardian-user",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "stale-guardian-user",
+        guardianExternalUserId: "stale-guardian-user",
+        guardianPrincipalId: "some-other-principal",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("stale_ignored");
+    expect(sessionMock).not.toHaveBeenCalled();
+    // Generic failure copy — no oracle about pending requests or permission.
+    expect(deliverSpy).toHaveBeenCalledWith(
+      "https://gateway.test/deliver",
+      expect.objectContaining({
+        text: "Sorry, I couldn't process that. Please try again.",
+      }),
+    );
+  });
+
+  test("guardian without a resolved acting principal is rejected before any decision", async () => {
+    // Address-only guardian classification (e.g. a binding row with a null
+    // principal) must not authorize decisions.
+    _anchorPrincipalId = "the-real-guardian-principal";
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-no-principal-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-no-principal-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "guardian-user-1",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "guardian-user-1",
+        guardianExternalUserId: "guardian-user-1",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("stale_ignored");
+    expect(sessionMock).not.toHaveBeenCalled();
+  });
+
+  test("guardian decision defers to the verdict when the anchor read is unresolvable", async () => {
+    // Transient gateway miss on the anchor read: the gateway-stamped verdict
+    // (which already classified the actor guardian by principal) wins.
+    _anchorPrincipalId = undefined;
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-anchor-miss-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-anchor-miss-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "guardian-user-1",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "guardian-user-1",
+        guardianExternalUserId: "guardian-user-1",
+        guardianPrincipalId: "guardian-principal-1",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("decision_applied");
+    expect(sessionMock).toHaveBeenCalled();
+  });
+
   test("unverified sender (no identity) auto-denies pending approval", async () => {
     const sessionMock = registerPendingInteraction(
       "req-unknown-auto-deny-1",
@@ -135,7 +280,7 @@ describe("approval interception trust-class gates", () => {
       trustCtx: {
         sourceChannel: "telegram",
         trustClass: "unknown",
-      } as TrustContext,
+      },
       assistantId: ASSISTANT_ID,
     });