@vellumai/assistant 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/runtime/guardian-vellum-migration.ts

@@ -10,13 +10,13 @@
 import type { ChannelId } from "../channels/types.js";
 import {
   findContactByAddress,
-  updateContactPrincipalAndChannel,
+  repairChannelAddress,
 } from "../contacts/contact-store.js";
 import {
   getGuardianDelivery,
   guardianForChannel,
 } from "../contacts/guardian-delivery-reader.js";
-import type { TrustContext } from "../daemon/trust-context.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
 import { getLogger } from "../util/logger.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "./assistant-scope.js";
 import {
@@ -43,10 +43,8 @@ const log = getLogger("guardian-vellum-migration");
  *
  * Returns true if healing occurred, false otherwise.
  *
- * The gateway binding supplies the authoritative principal; the local
- * assistant-mirror row is repaired to match the JWT principal because the
- * /v1/messages trust path still resolves against the local mirror in this
- * plan. A stale mirror must be repaired or valid guardians stay `unknown`.
+ * Repairs only the local assistant-mirror row; the gateway-owned binding —
+ * which trust classification actually reads — is untouched.
  */
 export async function healGuardianBindingDrift(
   incomingPrincipalId: string,
@@ -71,16 +69,10 @@ export async function healGuardianBindingDrift(
   // identity (channel + address) but not the local channel UUID write target,
   // so resolve that locally by the guardian's vellum-channel address.
   const localContact = findContactByAddress("vellum", guardian.address);
-  const localChannel = localContact?.channels.find(
-    (c) => c.type === "vellum",
-  );
+  const localChannel = localContact?.channels.find((c) => c.type === "vellum");
   if (!localContact || !localChannel) return false;
 
-  const updated = updateContactPrincipalAndChannel(
-    localContact.id,
-    localChannel.id,
-    incomingPrincipalId,
-  );
+  const updated = repairChannelAddress(localChannel.id, incomingPrincipalId);
 
   if (!updated) {
     log.warn(
@@ -105,8 +97,12 @@ export async function healGuardianBindingDrift(
 }
 
 /**
- * Re-resolve trust from the local mirror only for the narrow vellum-principal
- * reset-drift case; null when it isn't drift (caller keeps the gateway verdict).
+ * Detect the narrow vellum-principal reset-drift case, repair the local
+ * mirror to the incoming principal, and re-resolve trust; null when it isn't
+ * drift (caller keeps the gateway verdict). Re-resolution classifies against
+ * the gateway-owned guardian binding, so it recovers guardian trust only when
+ * that binding matches the incoming principal; gateway-side binding repair is
+ * deferred work.
  */
 export async function reResolveTrustOnResetDrift(
   incomingPrincipalId: string,

package/src/runtime/http-router-types.ts

@@ -0,0 +1,119 @@
+/**
+ * HTTP route definition vocabulary for the runtime HTTP server: the shape of a
+ * route entry (`HTTPRouteDefinition`), the per-handler context (`RouteContext`),
+ * and the OpenAPI metadata types that hang off them. Consumed by the router
+ * (`http-router.ts`) and the transport adapter (`routes/http-adapter.ts`).
+ */
+
+import type { z } from "zod";
+
+import type { RoutePolicy } from "./auth/route-policy.js";
+import type { AuthContext } from "./auth/types.js";
+import type {
+  RouteLoggingConfig,
+  RoutePathParam,
+  RouteRequestBody,
+  RouteResponseBody,
+} from "./routes/types.js";
+
+/** Extracted parameters from parameterized route matches. */
+export type RouteParams = Record<string, string>;
+
+/** The context available to every route handler. */
+export interface RouteContext {
+  req: Request;
+  url: URL;
+  server: ReturnType<typeof Bun.serve>;
+  authContext: AuthContext;
+  params: RouteParams;
+}
+
+/** Schema for an OpenAPI query parameter. */
+export interface RouteQueryParam {
+  name: string;
+  /** OpenAPI-style JSON Schema type (e.g. "string", "integer"). Defaults to "string". */
+  type?: string;
+  required?: boolean;
+  description?: string;
+  /** Inline JSON Schema for the parameter (overrides `type` when present). */
+  schema?: Record<string, unknown>;
+}
+
+/** Zod schema used to describe a request or response body.
+ * The generate-openapi script converts these to JSON Schema via z.toJSONSchema(). */
+export type RouteBodySchema = z.ZodType;
+
+/**
+ * Description for a non-200 response variant. Used when an endpoint has
+ * meaningful alternate response shapes that clients should handle (e.g.
+ * 502 `fetch_failed` on POST /v1/migrations/import when the URL body path
+ * can't reach the upstream bundle host).
+ */
+export interface RouteAdditionalResponse {
+  description: string;
+  /** Zod schema or plain JSON Schema fragment. */
+  schema?: RouteBodySchema | Record<string, unknown>;
+}
+
+/**
+ * A single route entry in the declarative table.
+ *
+ * - `endpoint`: The endpoint pattern after `/v1/`. Use `:paramName` for
+ *   single-segment params (e.g. `calls/:id/cancel`) or `:paramName*` for
+ *   catch-all params that match across slashes (e.g. `interfaces/:path*`).
+ * - `method`: HTTP method (GET, POST, DELETE, PATCH, PUT).
+ * - `handler`: Async function that produces the Response.
+ * - `policy`: Scope + principal-type policy for this route, or `null`
+ *   when the route is intentionally unprotected. See
+ *   `runtime/auth/route-policy.ts` for the type.
+ */
+export interface HTTPRouteDefinition {
+  endpoint: string;
+  method: string;
+  handler: (ctx: RouteContext) => Promise<Response> | Response;
+  policy: RoutePolicy | null;
+
+  /** Stable identifier used as the IPC method name when served over both transports. */
+  operationId?: string;
+
+  /** Typed path parameter constraints. When a param has `type: "uuid"`,
+   *  the compiled regex narrows the capture group so it only matches
+   *  UUID-shaped segments, preventing shadowing of literal sub-routes. */
+  pathParams?: RoutePathParam[];
+
+  // -- OpenAPI metadata (optional) ------------------------------------------
+  /** Short summary shown next to the operation in generated docs. */
+  summary?: string;
+  /** Longer description (Markdown-safe) for the operation. */
+  description?: string;
+  /** Grouping tags (e.g. "secrets", "identity"). Auto-derived from the route module filename when omitted. */
+  tags?: string[];
+  /** Query parameter definitions for the operation. */
+  queryParams?: RouteQueryParam[];
+  /**
+   * Request body for POST/PUT/PATCH/DELETE. A bare Zod schema is advertised
+   * as `application/json`; use the `{ contentType, schema }` form for non-JSON
+   * bodies (e.g. a raw `application/octet-stream` upload).
+   */
+  requestBody?: RouteRequestBody;
+  /**
+   * Success response body. A bare Zod schema is advertised as
+   * `application/json`; use the `{ contentType, schema }` form for non-JSON
+   * responses (e.g. a binary `application/octet-stream` download).
+   */
+  responseBody?: RouteResponseBody;
+  /**
+   * HTTP status code for the documented success response. Defaults to 200.
+   * Set to "202" for async endpoints that enqueue a job and return
+   * immediately — this keeps the generated OpenAPI spec aligned with the
+   * handler's actual `status:` value.
+   */
+  responseStatus?: string;
+  /** Additional response codes documented in the generated OpenAPI spec. */
+  additionalResponses?: Record<string, RouteAdditionalResponse>;
+  /**
+   * Per-route request-log control. See `RouteLoggingConfig` in `routes/types.ts`.
+   * When omitted, the route uses the default log-every-request behavior.
+   */
+  logging?: RouteLoggingConfig;
+}

package/src/runtime/http-router.ts

@@ -10,127 +10,14 @@
  * `normalizeEndpointForPolicy`.
  */
 
-import type { z } from "zod";
-
-import type { RoutePolicy } from "./auth/route-policy.js";
 import { enforcePolicy } from "./auth/route-policy.js";
 import type { AuthContext } from "./auth/types.js";
 import { httpError } from "./http-errors.js";
+import type { HTTPRouteDefinition, RouteParams } from "./http-router-types.js";
 import { withErrorHandling } from "./middleware/error-handler.js";
 import { routeDefinitionsToHTTPRoutes } from "./routes/http-adapter.js";
 import { ROUTES } from "./routes/index.js";
-import type {
-  RouteLoggingConfig,
-  RoutePathParam,
-  RouteRequestBody,
-  RouteResponseBody,
-} from "./routes/types.js";
-
-// ---------------------------------------------------------------------------
-// Route definition types
-// ---------------------------------------------------------------------------
-
-/** Extracted parameters from parameterized route matches. */
-export type RouteParams = Record<string, string>;
-
-/** The context available to every route handler. */
-export interface RouteContext {
-  req: Request;
-  url: URL;
-  server: ReturnType<typeof Bun.serve>;
-  authContext: AuthContext;
-  params: RouteParams;
-}
-
-/** Schema for an OpenAPI query parameter. */
-export interface RouteQueryParam {
-  name: string;
-  /** OpenAPI-style JSON Schema type (e.g. "string", "integer"). Defaults to "string". */
-  type?: string;
-  required?: boolean;
-  description?: string;
-  /** Inline JSON Schema for the parameter (overrides `type` when present). */
-  schema?: Record<string, unknown>;
-}
-
-/** Zod schema used to describe a request or response body.
- * The generate-openapi script converts these to JSON Schema via z.toJSONSchema(). */
-export type RouteBodySchema = z.ZodType;
-
-/**
- * Description for a non-200 response variant. Used when an endpoint has
- * meaningful alternate response shapes that clients should handle (e.g.
- * 502 `fetch_failed` on POST /v1/migrations/import when the URL body path
- * can't reach the upstream bundle host).
- */
-export interface RouteAdditionalResponse {
-  description: string;
-  /** Zod schema or plain JSON Schema fragment. */
-  schema?: RouteBodySchema | Record<string, unknown>;
-}
-
-/**
- * A single route entry in the declarative table.
- *
- * - `endpoint`: The endpoint pattern after `/v1/`. Use `:paramName` for
- *   single-segment params (e.g. `calls/:id/cancel`) or `:paramName*` for
- *   catch-all params that match across slashes (e.g. `interfaces/:path*`).
- * - `method`: HTTP method (GET, POST, DELETE, PATCH, PUT).
- * - `handler`: Async function that produces the Response.
- * - `policy`: Scope + principal-type policy for this route, or `null`
- *   when the route is intentionally unprotected. See
- *   `runtime/auth/route-policy.ts` for the type.
- */
-export interface HTTPRouteDefinition {
-  endpoint: string;
-  method: string;
-  handler: (ctx: RouteContext) => Promise<Response> | Response;
-  policy: RoutePolicy | null;
-
-  /** Stable identifier used as the IPC method name when served over both transports. */
-  operationId?: string;
-
-  /** Typed path parameter constraints. When a param has `type: "uuid"`,
-   *  the compiled regex narrows the capture group so it only matches
-   *  UUID-shaped segments, preventing shadowing of literal sub-routes. */
-  pathParams?: RoutePathParam[];
-
-  // -- OpenAPI metadata (optional) ------------------------------------------
-  /** Short summary shown next to the operation in generated docs. */
-  summary?: string;
-  /** Longer description (Markdown-safe) for the operation. */
-  description?: string;
-  /** Grouping tags (e.g. "secrets", "identity"). Auto-derived from the route module filename when omitted. */
-  tags?: string[];
-  /** Query parameter definitions for the operation. */
-  queryParams?: RouteQueryParam[];
-  /**
-   * Request body for POST/PUT/PATCH/DELETE. A bare Zod schema is advertised
-   * as `application/json`; use the `{ contentType, schema }` form for non-JSON
-   * bodies (e.g. a raw `application/octet-stream` upload).
-   */
-  requestBody?: RouteRequestBody;
-  /**
-   * Success response body. A bare Zod schema is advertised as
-   * `application/json`; use the `{ contentType, schema }` form for non-JSON
-   * responses (e.g. a binary `application/octet-stream` download).
-   */
-  responseBody?: RouteResponseBody;
-  /**
-   * HTTP status code for the documented success response. Defaults to 200.
-   * Set to "202" for async endpoints that enqueue a job and return
-   * immediately — this keeps the generated OpenAPI spec aligned with the
-   * handler's actual `status:` value.
-   */
-  responseStatus?: string;
-  /** Additional response codes documented in the generated OpenAPI spec. */
-  additionalResponses?: Record<string, RouteAdditionalResponse>;
-  /**
-   * Per-route request-log control. See `RouteLoggingConfig` in `routes/types.ts`.
-   * When omitted, the route uses the default log-every-request behavior.
-   */
-  logging?: RouteLoggingConfig;
-}
+import type { RouteLoggingConfig } from "./routes/types.js";
 
 // ---------------------------------------------------------------------------
 // Compiled route — internal representation with pre-built regex

package/src/runtime/http-server.ts

@@ -940,8 +940,17 @@ export class RuntimeHttpServer {
   ): Promise<void> {
     if (frame.type === "start") {
       if (ws.data.sessionId) {
-        this.sendLiveVoiceStateError(ws, "Live voice session already started");
-        return;
+        // A session that failed after `ready` releases its manager slot
+        // without a frame crossing this socket — heal the stale binding so
+        // the client can retry on the same connection.
+        if (this.liveVoiceSessionManager.isSessionActive(ws.data.sessionId)) {
+          this.sendLiveVoiceStateError(
+            ws,
+            "Live voice session already started",
+          );
+          return;
+        }
+        ws.data.sessionId = undefined;
       }
 
       const result = await this.liveVoiceSessionManager.startSession(frame, {

package/src/runtime/http-types.ts

@@ -23,7 +23,7 @@ export type {
   ApprovalCopyGenerator,
   ComposeApprovalMessageGenerativeOptions,
 } from "./message-composer-types.js";
-import type { TrustContext } from "../daemon/trust-context.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
 
 // ---------------------------------------------------------------------------
 // Approval conversation flow types

package/src/runtime/introduction-policy.ts

@@ -282,3 +282,92 @@ export function buildIntroductionActions(
   }
   return [{ id: "trust", label: "Trust", emphasis: "primary" }, ...tail];
 }
+
+// ---------------------------------------------------------------------------
+// Introduction mode (what prompted the card)
+// ---------------------------------------------------------------------------
+
+/**
+ * What prompted the introduction card. `denied` — the sender was refused
+ * (ACL or admission floor) and the guardian decides whether to let them in.
+ * `admitted` — the sender cleared the admission floor unclassified and the
+ * guardian is nudged to set their trust level while the conversation
+ * proceeds.
+ */
+export type AccessRequestTrigger = "denied" | "admitted";
+
+/**
+ * Per-mode policy for everything that differs between a deny-path access
+ * request and an admitted-mode introduction nudge. Single source of truth:
+ * copy, urgency, and the requester-facing lifecycle notice gates all read
+ * from this table, so adding a mode means adding one entry — not another
+ * branch per surface. Guardian-side decision semantics (the four actions,
+ * ACL writes, dedup/suppression) never vary by mode.
+ */
+export interface IntroductionModePolicy {
+  /** Attention-hint urgency for the guardian notification. */
+  urgency: "medium" | "high";
+  /** Card/notification title shared by every render surface. */
+  cardTitle: string;
+  /** Card subtitle (also the Slack card's no-preview body label). */
+  cardSubtitle: string;
+  /** questionText persisted on the canonical request row. */
+  questionText: (senderIdentifier: string) => string;
+  /** Contract-text identity line, given the assembled identity fragment. */
+  identityLine: (identity: string) => string;
+  /**
+   * Requester-facing lifecycle notice gates. An admitted sender made no
+   * request, so approved/denied/expired texts would misinform them.
+   * `verify_code` delivery is intentionally NOT gated here — the guardian
+   * explicitly chose a handshake, so the code must always reach the
+   * requester.
+   */
+  notifyRequesterOnTrust: boolean;
+  notifyRequesterOnDeny: boolean;
+  notifyRequesterOnExpiry: boolean;
+  /** Guardian confirmation for Leave unverified (desktop inline reply). */
+  leaveUnverifiedGuardianReply: (requesterLabel: string) => string;
+}
+
+const INTRODUCTION_MODES: Record<AccessRequestTrigger, IntroductionModePolicy> =
+  {
+    denied: {
+      urgency: "high",
+      cardTitle: "Access Request",
+      cardSubtitle: "Requesting access to the assistant",
+      questionText: (senderIdentifier) =>
+        `${senderIdentifier} is requesting access to the assistant`,
+      identityLine: (identity) =>
+        `${identity} is requesting access to the assistant.`,
+      notifyRequesterOnTrust: true,
+      notifyRequesterOnDeny: true,
+      notifyRequesterOnExpiry: true,
+      leaveUnverifiedGuardianReply: (requesterLabel) =>
+        `${requesterLabel} will stay unverified. They won't be able to message the assistant.`,
+    },
+    admitted: {
+      urgency: "medium",
+      cardTitle: "New Contact",
+      cardSubtitle: "Messaged your assistant — set their trust level",
+      questionText: (senderIdentifier) =>
+        `${senderIdentifier} messaged the assistant and was admitted — set their trust level`,
+      identityLine: (identity) =>
+        `${identity} messaged the assistant and was admitted under the channel's access setting — decide how much to trust them.`,
+      notifyRequesterOnTrust: false,
+      notifyRequesterOnDeny: false,
+      notifyRequesterOnExpiry: false,
+      leaveUnverifiedGuardianReply: (requesterLabel) =>
+        `${requesterLabel} will stay unverified.`,
+    },
+  };
+
+/**
+ * Resolve the mode policy from a payload or persisted trigger value.
+ * Anything other than `"admitted"` (including NULL rows that predate the
+ * trigger column) resolves to `denied` — the pre-existing behavior.
+ */
+export function introductionMode(
+  trigger: string | null | undefined,
+): IntroductionModePolicy {
+  return INTRODUCTION_MODES[trigger === "admitted" ? "admitted" : "denied"];
+}

package/src/runtime/local-actor-identity.ts

@@ -4,27 +4,21 @@
  * Local connections come from the native app via local HTTP sessions.
  * No actor token is sent over the connection; instead, the daemon assigns a
  * deterministic local actor identity server-side by looking up the vellum
- * channel guardian binding.
- *
- * This routes local connections through the same `resolveTrustContext`
- * pathway used by HTTP channel ingress, producing equivalent
- * guardian-context behavior for the vellum channel.
+ * channel guardian binding — the same gateway-owned binding
+ * `resolveLocalPrincipalTrustContext` maps trust from.
  */
 
-import type { ChannelId } from "../channels/types.js";
 import { isHttpAuthDisabled } from "../config/env.js";
 import {
   getGuardianDelivery,
   guardianForChannel,
   peekCachedGuardianDelivery,
 } from "../contacts/guardian-delivery-reader.js";
-import type { TrustContext } from "../daemon/trust-context.js";
 import { getLogger } from "../util/logger.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "./assistant-scope.js";
 import { CURRENT_POLICY_EPOCH } from "./auth/policy.js";
 import { resolveScopeProfile } from "./auth/scopes.js";
 import type { AuthContext } from "./auth/types.js";
-import { resolveTrustContext } from "./trust-context-resolver.js";
 
 const log = getLogger("local-actor-identity");
 
@@ -121,8 +115,8 @@ export function findLocalGuardianPrincipalIdFromStore(): string | undefined {
  * guardian's principalId when running in `DISABLE_HTTP_AUTH=true` mode.
  *
  * The dev-bypass `AuthContext` (`runtime/auth/middleware.ts`) injects
- * `"dev-bypass"` as the actor principal id for every request, but tool-side
- * trust resolution (`resolveLocalTrustContext`) and SSE registration both
+ * `"dev-bypass"` as the actor principal id for every request, but trust
+ * resolution (`resolveLocalPrincipalTrustContext`) and SSE registration both
  * carry the real local guardian principalId. Without this translation, every
  * targeted host_bash/host_file/host_cu/host_transfer result POST mismatches
  * the same-user check and is rejected with 403, and conversation/surface/
@@ -174,46 +168,6 @@ export function resolveActorPrincipalIdForLocalGuardianSync(
   return undefined;
 }
 
-/**
- * Resolve the guardian runtime context for a local connection.
- *
- * Looks up the vellum guardian binding to obtain the `guardianPrincipalId`,
- * then passes it as the sender identity through `resolveTrustContext` --
- * the same pathway HTTP channel routes use. This ensures local and HTTP
- * produce equivalent trust classification for the vellum channel.
- *
- * When no vellum guardian binding exists (e.g. fresh install before
- * bootstrap), falls back to a minimal guardian context so the local
- * user is not incorrectly denied.
- */
-export async function resolveLocalTrustContext(
-  sourceChannel: ChannelId = "vellum",
-): Promise<TrustContext> {
-  const assistantId = DAEMON_INTERNAL_ASSISTANT_ID;
-
-  const guardianPrincipalId = await findLocalGuardianPrincipalId();
-  if (guardianPrincipalId) {
-    const trustCtx = resolveTrustContext({
-      assistantId,
-      sourceChannel: "vellum",
-      conversationExternalId: "local",
-      actorExternalId: guardianPrincipalId,
-    });
-    return { ...trustCtx, sourceChannel };
-  }
-
-  log.warn(
-    "No vellum guardian binding found — gateway may not have started yet; falling back to minimal trust context",
-  );
-  const trustCtx = resolveTrustContext({
-    assistantId,
-    sourceChannel: "vellum",
-    conversationExternalId: "local",
-    actorExternalId: "local",
-  });
-  return { ...trustCtx, sourceChannel };
-}
-
 /**
  * Build an AuthContext for a local connection.
  *

package/src/runtime/local-principal-trust.ts

@@ -5,7 +5,7 @@
 
 import type { ChannelId } from "../channels/types.js";
 import { getGuardianDelivery } from "../contacts/guardian-delivery-reader.js";
-import type { TrustContext } from "../daemon/trust-context.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
 import { canonicalizeInboundIdentity } from "../util/canonicalize-identity.js";
 
 export interface ResolveLocalPrincipalTrustInput {

package/src/runtime/migrations/__tests__/gcs-signed-url.test.ts

@@ -8,7 +8,9 @@
  * - `http://` is rejected with reason `scheme`.
  * - A non-GCS host is rejected with reason `host`.
  * - A GCS URL with no signature query param is rejected with reason
- *   `missing_signature`.
+ *   `missing_signature`; SigV4 (`X-Amz-Signature`) is accepted only for
+ *   hosts on a non-default allowlist, and unsigned URLs are rejected
+ *   everywhere.
  * - A GCS URL with a non-default explicit port (e.g. `:1234`, `:80`) is
  *   rejected with reason `port`. A URL with `:443` is accepted because
  *   WHATWG URL normalizes the default HTTPS port to an empty port
@@ -111,6 +113,54 @@ describe("validateGcsSignedUrl", () => {
     expect(result).toEqual({ ok: false, reason: "missing_signature" });
   });
 
+  test("accepts a SigV4-signed URL for a host on a non-default allowlist", () => {
+    // The local/minikube platform serves SigV4 presigned URLs (SeaweedFS)
+    // over plain http — X-Amz-Signature satisfies the signature-shape
+    // requirement for explicitly allowlisted hosts.
+    const url =
+      "http://host.docker.internal:8000/bucket/object.tgz" +
+      "?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Signature=deadbeef";
+
+    const result = validateGcsSignedUrl(url, {
+      allowedHosts: ["host.docker.internal"],
+    });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.host).toBe("host.docker.internal");
+      expect(result.path).toBe("/bucket/object.tgz");
+    }
+  });
+
+  test("rejects an unsigned URL even on a non-default allowlist", () => {
+    const url = "http://host.docker.internal:8000/bucket/object.tgz";
+
+    const result = validateGcsSignedUrl(url, {
+      allowedHosts: ["host.docker.internal"],
+    });
+    expect(result).toEqual({ ok: false, reason: "missing_signature" });
+  });
+
+  test("rejects X-Amz-Signature on the default GCS allowlist", () => {
+    // SigV4 is only meaningful for allowlisted S3-compatible hosts; a GCS
+    // URL signed with the wrong scheme's param is not a GCS presigned URL.
+    const url =
+      "https://storage.googleapis.com/bucket/key?X-Amz-Signature=deadbeef";
+
+    const result = validateGcsSignedUrl(url);
+    expect(result).toEqual({ ok: false, reason: "missing_signature" });
+  });
+
+  test("still rejects traversal in a SigV4-signed allowlisted URL", () => {
+    const url =
+      "http://host.docker.internal:8000/bucket/../secret" +
+      "?X-Amz-Signature=deadbeef";
+
+    const result = validateGcsSignedUrl(url, {
+      allowedHosts: ["host.docker.internal"],
+    });
+    expect(result).toEqual({ ok: false, reason: "path_traversal" });
+  });
+
   test("rejects a GCS URL with a non-default port (1234)", () => {
     const url =
       "https://storage.googleapis.com:1234/bucket/key" +

package/src/runtime/migrations/__tests__/origin-mode.test.ts

@@ -0,0 +1,62 @@
+/**
+ * Tests for `getOriginMode` — the vbundle manifest `origin.mode` derivation.
+ *
+ * Covers:
+ * - `IS_PLATFORM=true` → "managed" (wins over IS_CONTAINERIZED).
+ * - `IS_CONTAINERIZED=true` (no IS_PLATFORM) → "self-hosted-remote".
+ * - Neither → "self-hosted-local".
+ * - Regression: a logged-in local assistant holding managed-proxy
+ *   credentials (platform URL + assistant_api_key) must NOT be classified
+ *   "managed" — every logged-in local has those credentials, and a
+ *   "managed" stamp trips the importer's `secrets_redacted must be true
+ *   when origin.mode is 'managed'` refine, breaking local→platform
+ *   teleport. The helper keys on the IS_PLATFORM deployment env only —
+ *   nothing here consults the credential store, so the regression case is
+ *   simply "no env flags set".
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { getOriginMode } from "../origin-mode.js";
+
+const ORIGINAL_IS_PLATFORM = process.env.IS_PLATFORM;
+const ORIGINAL_IS_CONTAINERIZED = process.env.IS_CONTAINERIZED;
+
+function restore(name: string, value: string | undefined): void {
+  if (value === undefined) {
+    delete process.env[name];
+  } else {
+    process.env[name] = value;
+  }
+}
+
+afterEach(() => {
+  restore("IS_PLATFORM", ORIGINAL_IS_PLATFORM);
+  restore("IS_CONTAINERIZED", ORIGINAL_IS_CONTAINERIZED);
+});
+
+describe("getOriginMode", () => {
+  test("IS_PLATFORM=true → managed", async () => {
+    process.env.IS_PLATFORM = "true";
+    delete process.env.IS_CONTAINERIZED;
+    expect(await getOriginMode()).toBe("managed");
+  });
+
+  test("IS_PLATFORM wins over IS_CONTAINERIZED", async () => {
+    process.env.IS_PLATFORM = "1";
+    process.env.IS_CONTAINERIZED = "true";
+    expect(await getOriginMode()).toBe("managed");
+  });
+
+  test("IS_CONTAINERIZED=true without IS_PLATFORM → self-hosted-remote", async () => {
+    delete process.env.IS_PLATFORM;
+    process.env.IS_CONTAINERIZED = "true";
+    expect(await getOriginMode()).toBe("self-hosted-remote");
+  });
+
+  test("neither flag → self-hosted-local (incl. logged-in locals with managed-proxy creds)", async () => {
+    delete process.env.IS_PLATFORM;
+    delete process.env.IS_CONTAINERIZED;
+    expect(await getOriginMode()).toBe("self-hosted-local");
+  });
+});