@vellumai/assistant 0.10.5-staging.2 → 0.10.5-staging.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.10.5-staging.2",
+  "version": "0.10.5-staging.3",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/compactor-media-strip.test.ts

@@ -0,0 +1,177 @@
+import { describe, expect, mock, test } from "bun:test";
+
+function makeLoggerStub(): Record<string, unknown> {
+  const stub: Record<string, unknown> = {};
+  for (const m of [
+    "info",
+    "warn",
+    "error",
+    "debug",
+    "trace",
+    "fatal",
+    "silent",
+    "child",
+  ]) {
+    stub[m] = m === "child" ? () => makeLoggerStub() : () => {};
+  }
+  return stub;
+}
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () => makeLoggerStub(),
+}));
+
+mock.module("../persistence/conversation-crud.js", () => ({
+  setConversationProcessingStartedAt: () => {},
+  isConversationProcessing: () => false,
+  getMessages: () => [],
+  reserveMessage: mock(async () => ({ id: "msg-reserve" })),
+}));
+
+mock.module("../persistence/attachments-store.js", () => ({
+  getAttachmentMetadataForMessage: () => [],
+  getAttachmentContent: () => null,
+}));
+
+import { runAssistantDrivenCompaction } from "../context/compactor.js";
+import type { Message, Provider } from "../providers/types.js";
+
+const TAIL_TIMESTAMP =
+  "2026-05-21 (Thursday) 10:00:00 -05:00 (America/Chicago)";
+
+const compactionResponse = `
+<compaction_result>
+<summary>
+Earlier turns summarized here.
+</summary>
+
+<key_state>
+- Nothing critical pending.
+</key_state>
+
+<tail_start timestamp="${TAIL_TIMESTAMP}" preview="tail anchor message" />
+</compaction_result>
+`;
+
+const OLD_SCREENSHOT_DATA = "b64-old-screenshot-bytes";
+const LATEST_SCREENSHOT_DATA = "b64-latest-screenshot-bytes";
+const USER_ATTACHED_IMAGE_DATA = "b64-user-attached-bytes";
+
+const userTextWithTurnContext = (text: string, timestamp: string): Message => ({
+  role: "user",
+  content: [
+    {
+      type: "text",
+      text: `<turn_context>\ncurrent_time: ${timestamp}\n</turn_context>\n${text}`,
+    },
+  ],
+});
+
+const assistantToolUse = (id: string): Message => ({
+  role: "assistant",
+  content: [{ type: "tool_use", id, name: "screenshot", input: {} }],
+});
+
+const toolResultWithImage = (id: string, data: string): Message => ({
+  role: "user",
+  content: [
+    {
+      type: "tool_result",
+      tool_use_id: id,
+      content: "captured",
+      contentBlocks: [
+        {
+          type: "image",
+          source: { type: "base64", media_type: "image/png", data },
+        },
+      ],
+    },
+  ],
+});
+
+const userWithAttachedImage = (): Message => ({
+  role: "user",
+  content: [
+    { type: "text", text: "here is a mockup" },
+    {
+      type: "image",
+      source: {
+        type: "base64",
+        media_type: "image/png",
+        data: USER_ATTACHED_IMAGE_DATA,
+      },
+    },
+  ],
+});
+
+function serializeBlocks(messages: Message[]): string {
+  return JSON.stringify(messages);
+}
+
+// Records the exact message list the provider is asked to summarize.
+function recordingProvider(sink: { sent: Message[] }): Provider {
+  return {
+    name: "mock-provider",
+    sendMessage: async (msgs: Message[]) => {
+      sink.sent = msgs;
+      return {
+        content: [{ type: "text", text: compactionResponse }],
+        model: "mock-model",
+        usage: { inputTokens: 100, outputTokens: 50 },
+        stopReason: "end_turn",
+      };
+    },
+  };
+}
+
+// The summary request must carry the same media-stripped projection the agent
+// loop sends on its own model calls. An unsanitized history resends every
+// screenshot in the conversation; enough of them cross Anthropic's many-image
+// threshold, where a stricter per-image dimension cap rejects the whole
+// summary call (and trips the compaction circuit breaker).
+describe("compaction summary calls — old tool-result media stripping", () => {
+  test("runAssistantDrivenCompaction strips images from older tool results, keeps the latest turn's image and user-attached images, and leaves durable history untouched", async () => {
+    // GIVEN a screenshot-heavy history: older tool results with images, a
+    // user-attached image, and a most-recent tool result with an image
+    const messages: Message[] = [
+      userWithAttachedImage(),
+      assistantToolUse("tu_old_1"),
+      toolResultWithImage("tu_old_1", OLD_SCREENSHOT_DATA),
+      userTextWithTurnContext("tail anchor message", TAIL_TIMESTAMP),
+      assistantToolUse("tu_latest"),
+      toolResultWithImage("tu_latest", LATEST_SCREENSHOT_DATA),
+    ];
+
+    // AND a snapshot of the caller's array so we can assert it is not mutated
+    const inputSnapshot = serializeBlocks(messages);
+    const sink = { sent: [] as Message[] };
+
+    // WHEN compaction runs over that history
+    const result = await runAssistantDrivenCompaction({
+      conversationId: "conv-media-strip",
+      messages,
+      provider: recordingProvider(sink),
+      systemPrompt: "system",
+      compaction: { enabled: true, autoThreshold: 0.7 },
+      // Large budget so the request is not front-truncated — this test
+      // exercises the media-strip sanitizer, not the truncation fallback.
+      maxInputTokens: 100000,
+      previousEstimatedInputTokens: 90000,
+    });
+
+    // THEN older tool-result screenshots are replaced with a text marker
+    const sentSerialized = serializeBlocks(sink.sent);
+    expect(sentSerialized).not.toContain(OLD_SCREENSHOT_DATA);
+    expect(sentSerialized).toContain("binary data removed to save context");
+
+    // AND the most recent tool-result turn keeps its image (the model may
+    // still need it), as do images the user attached directly
+    expect(sentSerialized).toContain(LATEST_SCREENSHOT_DATA);
+    expect(sentSerialized).toContain(USER_ATTACHED_IMAGE_DATA);
+
+    // AND the caller's durable history array is left byte-for-byte untouched,
+    // so persisted messages keep the original rich blocks
+    expect(serializeBlocks(messages)).toBe(inputSnapshot);
+    expect(result.compacted).toBe(true);
+  });
+});

package/src/__tests__/conversation-history-web-search.test.ts

@@ -622,6 +622,13 @@ describe("web_search_tool_result structural guard", () => {
     "context/post-turn-tool-result-truncation.ts",
     "context/tool-result-spool.ts",
 
+    // Outbound sanitize bundle: the media-strip and AX-tree transforms
+    // operate on locally-executed tool results (media contentBlocks and
+    // <ax-tree> text), which web_search_tool_result blocks never carry.
+    // Web-search blocks are handled by the bundle's own third transform
+    // (stripHistoricalWebSearchResults), so nothing is silently dropped.
+    "context/outbound-sanitize.ts",
+
     // Anthropic provider type guards define API-specific discriminants.
     // It has a separate isWebSearchToolResultBlock for the other type.
     "providers/anthropic/client.ts",

package/src/__tests__/guardian-question-mode.test.ts

@@ -9,10 +9,12 @@ import {
   buildGuardianRequestCodeInstruction,
   hasGuardianRequestCodeInstruction,
   parseGuardianQuestionPayload,
+  parseInteractiveApprovalPayload,
   resolveGuardianInstructionModeForRequest,
   resolveGuardianInstructionModeFromFields,
   resolveGuardianQuestionInstructionMode,
   stripConflictingGuardianRequestInstructions,
+  stripGuardianRequestCodeInstructions,
 } from "../notifications/guardian-question-mode.js";
 
 describe("guardian-question-mode", () => {
@@ -228,4 +230,59 @@ describe("guardian-question-mode", () => {
       ),
     ).toBe("");
   });
+
+  test("stripGuardianRequestCodeInstructions removes both-mode directives and bare code mentions", () => {
+    const text = [
+      "Alice is asking to run ls /tmp.",
+      "Approval code: A1B2C3",
+      'Reference code: A1B2C3. Reply "A1B2C3 approve" or "A1B2C3 reject".',
+      'Reply "A1B2C3 <your answer>".',
+    ].join("\n");
+
+    expect(stripGuardianRequestCodeInstructions(text, "A1B2C3")).toBe(
+      "Alice is asking to run ls /tmp.",
+    );
+  });
+
+  test("stripGuardianRequestCodeInstructions leaves unrelated text and other codes intact", () => {
+    const text = 'Approval code: ZZZZZZ. Reply "A1B2C3 approve" if you agree.';
+    expect(stripGuardianRequestCodeInstructions(text, "A1B2C3")).toBe(text);
+  });
+
+  test("parseInteractiveApprovalPayload accepts approval-mode payloads with a requestId", () => {
+    expect(
+      parseInteractiveApprovalPayload({
+        requestKind: "tool_grant_request",
+        requestId: "req-1",
+        requestCode: "A1B2C3",
+        questionText: "Allow host bash?",
+        toolName: "host_bash",
+      }),
+    ).not.toBeNull();
+  });
+
+  test("parseInteractiveApprovalPayload rejects answer-mode and unparseable payloads", () => {
+    // Answer mode: free-text questions get no Approve/Reject buttons.
+    expect(
+      parseInteractiveApprovalPayload({
+        requestKind: "pending_question",
+        requestId: "req-2",
+        requestCode: "A1B2C3",
+        questionText: "What time works?",
+        callSessionId: "call-1",
+        activeGuardianRequestCount: 1,
+      }),
+    ).toBeNull();
+
+    // Strict-parse failure: missing required pending_question fields.
+    expect(
+      parseInteractiveApprovalPayload({
+        requestKind: "pending_question",
+        requestId: "req-3",
+        requestCode: "A1B2C3",
+        questionText: "Allow send_email?",
+        toolName: "send_email",
+      }),
+    ).toBeNull();
+  });
 });

package/src/__tests__/notification-decision-fallback.test.ts

@@ -285,6 +285,100 @@ describe("notification decision fallback copy", () => {
     expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 reject"');
     expect(decision.renderedCopy.vellum?.body).not.toContain("<your answer>");
   });
+
+  test("slack approval copy is stripped of request-code instructions instead of enforced", async () => {
+    const signal = makeSignal({
+      contextPayload: {
+        requestId: "req-grant-slack-1",
+        questionText: "Approve tool: bash — ls /tmp (requested by Alice)",
+        requestCode: "A1B2C3",
+        requestKind: "tool_grant_request",
+        toolName: "bash",
+      },
+    });
+
+    const decision = await evaluateSignal(signal, [
+      "vellum",
+      "slack",
+    ] as NotificationChannel[]);
+
+    expect(decision.fallbackUsed).toBe(true);
+    // Vellum keeps the code-reply directive.
+    expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 approve"');
+    // Slack renders Approve/Reject buttons — no code anywhere in its copy.
+    expect(decision.renderedCopy.slack?.body).toBe(
+      "Approve tool: bash — ls /tmp (requested by Alice)",
+    );
+    expect(decision.renderedCopy.slack?.body).not.toContain("A1B2C3");
+  });
+
+  test("slack copy strips LLM-authored approval-code phrasing for approval requests", async () => {
+    configuredProvider = {
+      sendMessage: async () => ({ content: [] }),
+    };
+    extractedToolUse = {
+      name: "record_notification_decision",
+      input: {
+        shouldNotify: true,
+        selectedChannels: ["slack"],
+        reasoningSummary: "LLM decision",
+        renderedCopy: {
+          slack: {
+            title: "Tool Grant Request",
+            body: "Alice is asking to run ls /tmp.",
+            deliveryText:
+              'Alice is asking to run ls /tmp.\nApproval code: A1B2C3\nReference code: A1B2C3. Reply "A1B2C3 approve" or "A1B2C3 reject".',
+          },
+        },
+        dedupeKey: "guardian-question-slack-llm-test",
+        confidence: 0.9,
+      },
+    };
+
+    const signal = makeSignal({
+      contextPayload: {
+        requestId: "req-grant-slack-2",
+        questionText: "Approve tool: bash — ls /tmp (requested by Alice)",
+        requestCode: "A1B2C3",
+        requestKind: "tool_grant_request",
+        toolName: "bash",
+      },
+    });
+
+    const decision = await evaluateSignal(signal, [
+      "slack",
+    ] as NotificationChannel[]);
+
+    expect(decision.fallbackUsed).toBe(false);
+    expect(decision.renderedCopy.slack?.deliveryText).toBe(
+      "Alice is asking to run ls /tmp.",
+    );
+    expect(decision.renderedCopy.slack?.body).toBe(
+      "Alice is asking to run ls /tmp.",
+    );
+  });
+
+  test("slack answer-mode questions keep code instructions (no buttons render)", async () => {
+    const signal = makeSignal({
+      contextPayload: {
+        requestId: "req-pending-slack-1",
+        questionText: "What is the gate code?",
+        requestCode: "A1B2C3",
+        requestKind: "pending_question",
+        callSessionId: "call-1",
+        activeGuardianRequestCount: 1,
+      },
+    });
+
+    const decision = await evaluateSignal(signal, [
+      "slack",
+    ] as NotificationChannel[]);
+
+    expect(decision.fallbackUsed).toBe(true);
+    expect(decision.renderedCopy.slack?.body).toContain(
+      '"A1B2C3 <your answer>"',
+    );
+  });
 });
 
 // ── Access-request instruction enforcement ──────────────────────────────

package/src/__tests__/pre-model-call-sanitize.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 
-import { preModelCallSanitize } from "../agent/loop.js";
+import { preModelCallSanitize } from "../context/outbound-sanitize.js";
 import type { Message } from "../providers/types.js";
 
 /**

package/src/__tests__/slack-notification-approval-card.test.ts

@@ -10,7 +10,7 @@ import type { ApprovalUIMetadata } from "../runtime/channel-approval-types.js";
  * quoted-preview body, action callback ids, source/permalink and requester-id
  * context blocks, the security-warning context block, and guardian
  * verification note that `buildApprovalNotificationBlocks` emits for an
- * access request.
+ * access request — plus the tool-approval card body/continuation split.
  */
 
 const APPROVAL: ApprovalUIMetadata = {
@@ -39,7 +39,9 @@ type Block = Record<string, unknown>;
 
 function card(blocks: unknown[]): Block {
   const c = (blocks as Block[]).find((b) => b.type === "card");
-  if (!c) throw new Error("no card block");
+  if (!c) {
+    throw new Error("no card block");
+  }
   return c;
 }
 
@@ -174,3 +176,88 @@ describe("Slack access-request card blocks", () => {
     ).toBe(true);
   });
 });
+
+const TOOL_APPROVAL: ApprovalUIMetadata = {
+  requestId: "req-456",
+  actions: [
+    { id: "approve_once", label: "Approve once" },
+    { id: "reject", label: "Reject" },
+  ],
+  plainTextFallback: 'Reply "ABC123 approve" or "ABC123 reject"',
+  permissionDetails: {
+    toolName: "bash",
+    riskLevel: "medium",
+    toolInput: { command: "ls /tmp" },
+    requesterIdentifier: "Alice",
+  },
+};
+
+function buildToolApprovalPayload(): ChannelDeliveryPayload {
+  return {
+    sourceEventName: "guardian.question",
+    copy: { title: "Guardian Question", body: "Approve tool: bash" },
+    urgency: "high",
+    approvalContext: TOOL_APPROVAL,
+  };
+}
+
+function sectionTexts(blocks: unknown[]): string[] {
+  return (blocks as Block[])
+    .filter((b) => b.type === "section")
+    .map((b) => text(b.text));
+}
+
+describe("Slack tool-approval card blocks", () => {
+  test("short message renders entirely in the card body with no companion section", () => {
+    const message = "Alice is requesting approval to run: ls /tmp";
+    const blocks = buildApprovalNotificationBlocks(
+      buildToolApprovalPayload(),
+      message,
+    );
+    expect(text(card(blocks).body)).toBe(message);
+    expect(sectionTexts(blocks)).toHaveLength(0);
+  });
+
+  test("card carries tool title and tool/requester subtitle", () => {
+    const c = card(
+      buildApprovalNotificationBlocks(buildToolApprovalPayload(), "msg"),
+    );
+    expect(text(c.title)).toBe("Tool Approval");
+    expect(text(c.subtitle)).toBe("bash — requested by Alice");
+  });
+
+  test("long message continues in a section without repeating the card body", () => {
+    const message = Array.from(
+      { length: 40 },
+      (_, i) => `word${String(i).padStart(2, "0")}`,
+    ).join(" "); // 279 chars of distinct words
+    const blocks = buildApprovalNotificationBlocks(
+      buildToolApprovalPayload(),
+      message,
+    );
+
+    const body = text(card(blocks).body);
+    expect(body.length).toBeLessThanOrEqual(200);
+    expect(body.endsWith(" ↓")).toBe(true);
+
+    const sections = sectionTexts(blocks);
+    expect(sections).toHaveLength(1);
+    const continuation = sections[0];
+
+    // Body + continuation reassemble the full message with nothing repeated
+    // and nothing lost — the guardian reads each word exactly once.
+    const bodyWords = body.replace(/ ↓$/, "").split(" ");
+    const continuationWords = continuation.replace(/^… /, "").split(" ");
+    expect([...bodyWords, ...continuationWords].join(" ")).toBe(message);
+  });
+
+  test("split lands on a word boundary", () => {
+    const message = `${"a".repeat(190)} ${"b".repeat(60)}`;
+    const blocks = buildApprovalNotificationBlocks(
+      buildToolApprovalPayload(),
+      message,
+    );
+    expect(text(card(blocks).body)).toBe(`${"a".repeat(190)} ↓`);
+    expect(sectionTexts(blocks)[0]).toBe(`… ${"b".repeat(60)}`);
+  });
+});

package/src/agent/ax-tree-compaction.test.ts

@@ -1,7 +1,10 @@
 import { describe, expect, test } from "bun:test";
 
+import {
+  compactAxTreeHistory,
+  escapeAxTreeContent,
+} from "../context/outbound-sanitize.js";
 import type { Message } from "../providers/types.js";
-import { compactAxTreeHistory, escapeAxTreeContent } from "./loop.js";
 
 // ---------------------------------------------------------------------------
 // Helpers