@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/__tests__/build-persisted-content.test.ts

@@ -11,35 +11,6 @@
  */
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-// ── Mock platform (must precede imports that read it) ─────────────────────────
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
-mock.module("../config/loader.js", () => ({
-  getConfig: () => ({
-    skills: {
-      entries: {},
-      load: { extraDirs: [], watch: false, watchDebounceMs: 0 },
-      install: { nodeManager: "npm" },
-      allowBundled: null,
-      remoteProviders: {
-        skillssh: { enabled: true },
-        clawhub: { enabled: true },
-      },
-      remotePolicy: {
-        blockSuspicious: true,
-        blockMalware: true,
-        maxSkillsShRisk: "medium",
-      },
-    },
-  }),
-  loadConfig: () => ({}),
-}));
-
 mock.module("../persistence/conversation-crud.js", () => ({
   setConversationProcessingStartedAt: () => {},
   isConversationProcessing: () => false,
@@ -56,12 +27,20 @@ mock.module("../persistence/llm-request-log-store.js", () => ({
 }));
 
 // ── Imports (after mocks) ─────────────────────────────────────────────────────
+import { REDACTED_SENTINEL_OPEN } from "@vellumai/service-contracts/redacted-credential";
+
+import type { ResolvedRevealCandidate } from "../daemon/chat-credential-redaction.js";
 import {
   buildPersistedAssistantContent,
   stampThinkingTiming,
 } from "../daemon/conversation-agent-loop-handlers.js";
 import type { ToolActivityMetadata } from "../daemon/message-types/web-activity.js";
 import type { ContentBlock } from "../providers/types.js";
+import {
+  OPENAI_PROJECT_KEY_REDACTION_MARKER,
+  SYNTHETIC_OPAQUE_CREDENTIAL,
+  SYNTHETIC_OPENAI_PROJECT_KEY,
+} from "./secret-fixtures.js";
 
 const webSearchActivity: ToolActivityMetadata = {
   webSearch: {
@@ -258,3 +237,91 @@ describe("stampThinkingTiming", () => {
     expect(stamped[1]).not.toHaveProperty("_startedAt");
   });
 });
+
+/**
+ * The `chat-credential-reveal` gate lives one layer up in
+ * `chatRevealCandidates`, which yields `undefined` when the flag is off — so
+ * `revealCandidates: undefined` here is the flag-off persist path, and the
+ * default configuration. Redaction is not what the flag selects: a
+ * route-proven reveal plaintext must stay out of the persisted row in both
+ * modes, via the flag-independent `legacyFallbackCandidates` seam.
+ */
+describe("buildPersistedAssistantContent — legacy (flag-off) redaction", () => {
+  const openaiCandidate: ResolvedRevealCandidate = {
+    service: "openai",
+    field: "api_key",
+    value: SYNTHETIC_OPENAI_PROJECT_KEY,
+  };
+  const opaqueCandidate: ResolvedRevealCandidate = {
+    service: "acme",
+    field: "token",
+    value: SYNTHETIC_OPAQUE_CREDENTIAL,
+  };
+
+  function persistText(
+    text: string,
+    revealCandidates?: readonly ResolvedRevealCandidate[],
+    legacyFallbackCandidates: readonly ResolvedRevealCandidate[] = [],
+  ): string {
+    const built = buildPersistedAssistantContent(
+      [{ type: "text", text }] as unknown as ContentBlock[],
+      [],
+      undefined,
+      revealCandidates,
+      legacyFallbackCandidates,
+    ) as unknown as Array<Record<string, unknown>>;
+    return built[0].text as string;
+  }
+
+  test("emits the legacy marker for a scanner match, never sentinel glyphs", () => {
+    const out = persistText(`key: ${SYNTHETIC_OPENAI_PROJECT_KEY}`);
+
+    expect(out).toBe(`key: ${OPENAI_PROJECT_KEY_REDACTION_MARKER}`);
+    expect(out).not.toContain(SYNTHETIC_OPENAI_PROJECT_KEY);
+    expect(out).not.toContain(REDACTED_SENTINEL_OPEN);
+  });
+
+  test("redacts a proven candidate the scanner cannot classify", () => {
+    // The opaque value has no scanner-recognizable shape, so the fallback is
+    // the only thing standing between it and a raw persisted row.
+    const out = persistText(
+      `token: ${SYNTHETIC_OPAQUE_CREDENTIAL}`,
+      undefined,
+      [opaqueCandidate],
+    );
+
+    expect(out).not.toContain(SYNTHETIC_OPAQUE_CREDENTIAL);
+    expect(out).toContain("<redacted");
+    expect(out).not.toContain(REDACTED_SENTINEL_OPEN);
+  });
+
+  test("marks the block neutralization-aware in legacy mode too", () => {
+    // `renderHistoryContent` neutralizes any block lacking the rider, so a
+    // legacy-mode row must still carry it or its own text gets re-scanned.
+    const built = buildPersistedAssistantContent(
+      [{ type: "text", text: "no secrets here" }] as unknown as ContentBlock[],
+      [],
+    ) as unknown as Array<Record<string, unknown>>;
+
+    expect(built[0]._redactionVersion).toBe(2);
+  });
+
+  test("sentinel mode enriches the same candidate the legacy path flattens", () => {
+    // Candidate spans are protected ahead of the scanner in both modes, so the
+    // legacy marker reports the generic type while the sentinel carries the
+    // vault identity the chip needs.
+    const legacy = persistText(
+      `key: ${SYNTHETIC_OPENAI_PROJECT_KEY}`,
+      undefined,
+      [openaiCandidate],
+    );
+    const sentinel = persistText(`key: ${SYNTHETIC_OPENAI_PROJECT_KEY}`, [
+      openaiCandidate,
+    ]);
+
+    expect(legacy).toBe('key: <redacted type="Credential" />');
+    expect(sentinel).toBe(
+      "key: 〔redacted:OpenAI Project Key:openai:api_key〕",
+    );
+  });
+});

package/src/__tests__/bundle-scanner.test.ts

@@ -12,7 +12,7 @@ import { scanBundle, type ScanFinding } from "../bundler/bundle-scanner.js";
 // ---------------------------------------------------------------------------
 
 const MINIMAL_MANIFEST = {
-  format_version: "1",
+  format_version: "2",
   name: "test-app",
   created_at: "2025-01-01T00:00:00Z",
   created_by: "test",
@@ -62,6 +62,32 @@ function findByCode(
   return findings.find((f) => f.code === code);
 }
 
+// ---------------------------------------------------------------------------
+// Format version gate (block)
+// ---------------------------------------------------------------------------
+
+describe("format_version gate", () => {
+  test("blocks legacy format_version 1 bundles", async () => {
+    const path = await createBundle(
+      { "index.html": "<html><body>Hello</body></html>" },
+      { ...MINIMAL_MANIFEST, format_version: 1 },
+    );
+    const result = await scanBundle(path);
+    const f = findByCode(result.findings, "unsupported_format");
+    expect(f).toBeDefined();
+    expect(f!.level).toBe("block");
+    expect(result.passed).toBe(false);
+  });
+
+  test("passes format_version 2 bundles", async () => {
+    const path = await createBundle({
+      "index.html": "<html><body>Hello</body></html>",
+    });
+    const result = await scanBundle(path);
+    expect(findByCode(result.findings, "unsupported_format")).toBeUndefined();
+  });
+});
+
 // ---------------------------------------------------------------------------
 // SVG <script> tags (block)
 // ---------------------------------------------------------------------------

package/src/__tests__/call-controller.test.ts

@@ -10,85 +10,23 @@ import {
 
 mock.module("../config/env.js", () => ({ isHttpAuthDisabled: () => true }));
 
-// ── Logger mock (must come before any source imports) ────
+// Guardian requests/deliveries are created through the gateway client; serve
+// that surface from the in-memory sim so dispatch never opens IPC.
+import {
+  bridgeState,
+  gatewayGuardianRequestsStoreBridge,
+} from "./helpers/gateway-guardian-requests-store-bridge.js";
 
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
+mock.module(
+  "../channels/gateway-guardian-requests.js",
+  () => gatewayGuardianRequestsStoreBridge,
+);
 
-// ── Config mock ─────────────────────────────────────────────────────
-
-mock.module("../config/loader.js", () => {
-  const config = {
-    ui: {},
-
-    provider: "anthropic",
-    calls: {
-      enabled: true,
-      provider: "twilio",
-      maxDurationSeconds: 12 * 60,
-      userConsultTimeoutSeconds: 90,
-      userConsultationTimeoutSeconds: 90,
-      silenceTimeoutSeconds: 30,
-      disclosure: { enabled: false, text: "" },
-      safety: { denyCategories: [] },
-    },
-    memory: { enabled: false },
-    notifications: {},
-    ingress: {
-      enabled: true,
-      publicBaseUrl: "https://generic.example.com",
-    },
-    services: {
-      tts: {
-        mode: "your-own" as const,
-        provider: "elevenlabs",
-        providers: {
-          elevenlabs: {
-            voiceId: "ZF6FPAbjXT4488VcRRnw",
-            voiceModelId: "",
-            speed: 1.0,
-            stability: 0.5,
-            similarityBoost: 0.75,
-            conversationTimeoutSeconds: 30,
-          },
-          "fish-audio": {
-            referenceId: "",
-            chunkLength: 200,
-            format: "mp3",
-            latency: "normal",
-            speed: 1.0,
-          },
-          deepgram: {
-            model: "aura-2-theia-en",
-            format: "mp3",
-          },
-        },
-      },
-    },
-    elevenlabs: {
-      voiceId: "ZF6FPAbjXT4488VcRRnw",
-    },
-    fishAudio: {
-      referenceId: "",
-      format: "mp3",
-    },
-  };
-  return {
-    getConfig: () => config,
-    loadConfig: () => config,
-    loadRawConfig: () => ({}),
-    saveRawConfig: () => {},
-    invalidateConfigCache: () => {},
-    applyNestedDefaults: (c: unknown) => c,
-    getNestedValue: () => undefined,
-    setNestedValue: () => {},
-    API_KEY_PROVIDERS: [],
-  };
-});
+// ── Config ──────────────────────────────────────────────────────────
+// These tests run against the real config loader. `loadConfig()` returns the
+// loader's live cached object, so tests set TTS/ingress fields by mutating it
+// in place; `beforeEach` restores the fields the tests touch. The workspace
+// config file itself is seeded once below (memory off, ingress base URL).
 
 // ── Credential mock (prevents real key lookups) ──────────────────────
 
@@ -149,7 +87,9 @@ function createMockVoiceTurn(tokens: string[]) {
 
     // Emit text deltas
     for (const token of tokens) {
-      if (opts.signal?.aborted) break;
+      if (opts.signal?.aborted) {
+        break;
+      }
       opts.onTextDelta(token);
     }
 
@@ -276,10 +216,6 @@ import {
 import type { CallTransport } from "../calls/call-transport.js";
 import { resolveCallTtsProvider } from "../calls/resolve-call-tts-provider.js";
 import { loadConfig } from "../config/loader.js";
-import {
-  getCanonicalGuardianRequest,
-  getPendingCanonicalRequestByCallSessionId,
-} from "../contacts/canonical-guardian-store.js";
 import { getMessages } from "../persistence/conversation-crud.js";
 import { getDb } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
@@ -287,6 +223,15 @@ import { resetTestTables } from "../persistence/raw-query.js";
 import { conversations } from "../persistence/schema/index.js";
 import { resetDbForTesting } from "./db-test-helpers.js";
 import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
+import { setConfig } from "./helpers/set-config.js";
+
+// Disable memory so persisted call messages skip background indexing, and
+// seed the ingress base URL used for synthesized-audio play URLs.
+setConfig("memory", { enabled: false });
+setConfig("ingress", {
+  enabled: true,
+  publicBaseUrl: "https://generic.example.com",
+});
 
 await initializeDb();
 
@@ -341,7 +286,9 @@ function createMockTransport(): MockTransport {
 
 let ensuredConvIds = new Set<string>();
 function ensureConversation(id: string): void {
-  if (ensuredConvIds.has(id)) return;
+  if (ensuredConvIds.has(id)) {
+    return;
+  }
   const db = getDb();
   const now = Date.now();
   db.insert(conversations)
@@ -355,12 +302,19 @@ function ensureConversation(id: string): void {
   ensuredConvIds.add(id);
 }
 
+function pendingRequestByCallSession(callSessionId: string) {
+  return (
+    [...bridgeState.requests.values()]
+      .filter(
+        (r) => r.callSessionId === callSessionId && r.status === "pending",
+      )
+      .sort((a, b) => b.createdAt - a.createdAt)[0] ?? null
+  );
+}
+
 function resetTables() {
+  bridgeState.reset();
   resetTestTables(
-    "canonical_guardian_deliveries",
-    "canonical_guardian_requests",
-    "guardian_action_deliveries",
-    "guardian_action_requests",
     "call_pending_questions",
     "call_events",
     "call_sessions",
@@ -394,8 +348,9 @@ async function pollUntil(
 ): Promise<void> {
   const deadline = Date.now() + timeoutMs;
   while (!predicate()) {
-    if (Date.now() > deadline)
+    if (Date.now() > deadline) {
       throw new Error(`pollUntil timed out after ${timeoutMs}ms`);
+    }
     await new Promise((r) => setTimeout(r, intervalMs));
   }
 }
@@ -436,25 +391,17 @@ function getLatestAssistantText(conversationId: string): string | null {
   const msgs = getMessages(conversationId).filter(
     (m) => m.role === "assistant",
   );
-  if (msgs.length === 0) return null;
-  const latest = msgs[msgs.length - 1];
-  try {
-    const parsed = JSON.parse(latest.content) as unknown;
-    if (Array.isArray(parsed)) {
-      return parsed
-        .filter(
-          (b): b is { type: string; text?: string } =>
-            typeof b === "object" && b != null,
-        )
-        .filter((b) => b.type === "text")
-        .map((b) => b.text ?? "")
-        .join("");
-    }
-    if (typeof parsed === "string") return parsed;
-  } catch {
-    /* fall through */
+  if (msgs.length === 0) {
+    return null;
   }
-  return latest.content;
+  const latest = msgs[msgs.length - 1];
+  return latest.content
+    .filter(
+      (b): b is { type: "text"; text: string } =>
+        b.type === "text" && typeof (b as { text?: unknown }).text === "string",
+    )
+    .map((b) => b.text)
+    .join("");
 }
 
 function setupControllerWithOrigin(task?: string) {
@@ -1866,14 +1813,10 @@ describe("call-controller", () => {
 
       // Poll until the async dispatchGuardianQuestion creates the request
       // (the dispatch is fire-and-forget and may take longer on slow CI)
-      await pollUntil(
-        () => !!getPendingCanonicalRequestByCallSessionId(session.id),
-      );
+      await pollUntil(() => !!pendingRequestByCallSession(session.id));
 
       // Verify a guardian action request was created
-      const pendingRequest = getPendingCanonicalRequestByCallSessionId(
-        session.id,
-      );
+      const pendingRequest = pendingRequestByCallSession(session.id);
       expect(pendingRequest).not.toBeNull();
       expect(pendingRequest!.status).toBe("pending");
 
@@ -1886,7 +1829,7 @@ describe("call-controller", () => {
 
       // Poll until the consultation timeout fires and expires the request
       await pollUntil(() => {
-        const req = getCanonicalGuardianRequest(pendingRequest!.id);
+        const req = bridgeState.getRequest(pendingRequest!.id);
         return req?.status === "expired";
       });
 
@@ -2009,9 +1952,7 @@ describe("call-controller", () => {
     expect(question!.questionText).toBe("Allow send_email to bob@example.com?");
 
     // Verify the guardian action request has tool metadata
-    const pendingRequest = getPendingCanonicalRequestByCallSessionId(
-      session.id,
-    );
+    const pendingRequest = pendingRequestByCallSession(session.id);
     expect(pendingRequest).not.toBeNull();
     expect(pendingRequest!.toolName).toBe("send_email");
     expect(pendingRequest!.inputDigest).not.toBeNull();
@@ -2041,7 +1982,7 @@ describe("call-controller", () => {
     await controller.handleCallerUtterance("Send it");
     await new Promise((r) => setTimeout(r, 10));
 
-    const request1 = getPendingCanonicalRequestByCallSessionId(session.id);
+    const request1 = pendingRequestByCallSession(session.id);
     expect(request1).not.toBeNull();
 
     // Compute expected digest independently using the same utility
@@ -2068,9 +2009,7 @@ describe("call-controller", () => {
     await new Promise((r) => setTimeout(r, 10));
 
     // Verify the guardian action request has NO tool metadata
-    const pendingRequest = getPendingCanonicalRequestByCallSessionId(
-      session.id,
-    );
+    const pendingRequest = pendingRequestByCallSession(session.id);
     expect(pendingRequest).not.toBeNull();
     expect(pendingRequest!.toolName).toBeNull();
     expect(pendingRequest!.inputDigest).toBeNull();
@@ -2132,9 +2071,7 @@ describe("call-controller", () => {
     expect(question!.questionText).toBe("Allow send_message?");
 
     // Verify tool metadata was parsed correctly
-    const pendingRequest = getPendingCanonicalRequestByCallSessionId(
-      session.id,
-    );
+    const pendingRequest = pendingRequestByCallSession(session.id);
     expect(pendingRequest).not.toBeNull();
     expect(pendingRequest!.toolName).toBe("send_message");
     expect(pendingRequest!.inputDigest).not.toBeNull();
@@ -2163,9 +2100,7 @@ describe("call-controller", () => {
     await controller.handleCallerUtterance("Do something");
     await new Promise((r) => setTimeout(r, 10));
 
-    const pendingRequest = getPendingCanonicalRequestByCallSessionId(
-      session.id,
-    );
+    const pendingRequest = pendingRequestByCallSession(session.id);
     expect(pendingRequest).not.toBeNull();
     expect(pendingRequest!.questionText).toBe("Fallback question?");
     // Tool metadata should be null since the approval marker was malformed
@@ -2321,7 +2256,7 @@ describe("call-controller", () => {
 
     const firstQuestionId = controller.getPendingConsultationQuestionId();
     expect(firstQuestionId).not.toBeNull();
-    const firstRequest = getPendingCanonicalRequestByCallSessionId(session.id);
+    const firstRequest = pendingRequestByCallSession(session.id);
     expect(firstRequest).not.toBeNull();
 
     // Repeated ASK_GUARDIAN with same informational question (no tool metadata)
@@ -2333,9 +2268,7 @@ describe("call-controller", () => {
 
     // Should coalesce: same consultation ID, same request
     expect(controller.getPendingConsultationQuestionId()).toBe(firstQuestionId);
-    const currentRequest = getPendingCanonicalRequestByCallSessionId(
-      session.id,
-    );
+    const currentRequest = pendingRequestByCallSession(session.id);
     expect(currentRequest).not.toBeNull();
     expect(currentRequest!.id).toBe(firstRequest!.id);
     expect(currentRequest!.status).toBe("pending");
@@ -2369,7 +2302,7 @@ describe("call-controller", () => {
 
     const firstQuestionId = controller.getPendingConsultationQuestionId();
     expect(firstQuestionId).not.toBeNull();
-    const firstRequest = getPendingCanonicalRequestByCallSessionId(session.id);
+    const firstRequest = pendingRequestByCallSession(session.id);
     expect(firstRequest).not.toBeNull();
 
     // Repeated ASK_GUARDIAN_APPROVAL with same tool/input
@@ -2383,9 +2316,7 @@ describe("call-controller", () => {
 
     // Should coalesce: same consultation, same request
     expect(controller.getPendingConsultationQuestionId()).toBe(firstQuestionId);
-    const currentRequest = getPendingCanonicalRequestByCallSessionId(
-      session.id,
-    );
+    const currentRequest = pendingRequestByCallSession(session.id);
     expect(currentRequest!.id).toBe(firstRequest!.id);
     expect(currentRequest!.status).toBe("pending");
 
@@ -2409,7 +2340,7 @@ describe("call-controller", () => {
     await controller.handleCallerUtterance("Send email");
     await new Promise((r) => setTimeout(r, 10));
 
-    const firstRequest = getPendingCanonicalRequestByCallSessionId(session.id);
+    const firstRequest = pendingRequestByCallSession(session.id);
     expect(firstRequest).not.toBeNull();
     expect(firstRequest!.toolName).toBe("send_email");
 
@@ -2430,13 +2361,13 @@ describe("call-controller", () => {
     await new Promise((r) => setTimeout(r, 10));
 
     // New consultation should be active
-    const secondRequest = getPendingCanonicalRequestByCallSessionId(session.id);
+    const secondRequest = pendingRequestByCallSession(session.id);
     expect(secondRequest).not.toBeNull();
     expect(secondRequest!.id).not.toBe(firstRequest!.id);
     expect(secondRequest!.toolName).toBe("calendar_create");
 
     // Old request should be expired (superseded by the new one)
-    const expiredRequest = getCanonicalGuardianRequest(firstRequest!.id);
+    const expiredRequest = bridgeState.getRequest(firstRequest!.id);
     expect(expiredRequest).not.toBeNull();
     expect(expiredRequest!.status).toBe("expired");
 
@@ -2460,7 +2391,7 @@ describe("call-controller", () => {
     await controller.handleCallerUtterance("Send email to Bob");
     await new Promise((r) => setTimeout(r, 10));
 
-    const firstRequest = getPendingCanonicalRequestByCallSessionId(session.id);
+    const firstRequest = pendingRequestByCallSession(session.id);
     expect(firstRequest).not.toBeNull();
     expect(firstRequest!.toolName).toBe("send_email");
 
@@ -2476,9 +2407,7 @@ describe("call-controller", () => {
     await new Promise((r) => setTimeout(r, 10));
 
     // Should coalesce: the inherited tool metadata matches the existing consultation
-    const currentRequest = getPendingCanonicalRequestByCallSessionId(
-      session.id,
-    );
+    const currentRequest = pendingRequestByCallSession(session.id);
     expect(currentRequest!.id).toBe(firstRequest!.id);
     expect(currentRequest!.status).toBe("pending");
 
@@ -3807,6 +3736,8 @@ describe("call-controller", () => {
     });
 
     test("returns fallback when the configured provider is not in the catalog", async () => {
+      // The schema enum rejects unknown providers, so this state can only be
+      // produced by mutating the loader's cached config directly.
       const cfg = loadConfig();
       (cfg.services.tts as { provider: string }).provider =
         "not-a-real-provider";
@@ -3913,7 +3844,9 @@ describe("call-controller", () => {
       const turnPromise = controller.handleCallerUtterance("Hello");
 
       // Wait for microtasks to settle
-      for (let i = 0; i < 5; i++) await Promise.resolve();
+      for (let i = 0; i < 5; i++) {
+        await Promise.resolve();
+      }
 
       // No outbound audio/tokens yet → still processing.
       expect(controller.getState()).toBe("processing");
@@ -3969,7 +3902,9 @@ describe("call-controller", () => {
 
       const { controller } = setupController();
       const turnPromise = controller.handleCallerUtterance("Hi");
-      for (let i = 0; i < 5; i++) await Promise.resolve();
+      for (let i = 0; i < 5; i++) {
+        await Promise.resolve();
+      }
 
       // Before any token: processing, barge-in ignored (turn not aborted).
       expect(controller.getState()).toBe("processing");
@@ -3978,7 +3913,9 @@ describe("call-controller", () => {
 
       // Release the first token → controller flips to speaking.
       emitFirstToken();
-      for (let i = 0; i < 5; i++) await Promise.resolve();
+      for (let i = 0; i < 5; i++) {
+        await Promise.resolve();
+      }
       expect(controller.getState()).toBe("speaking");
 
       // Now barge-in is accepted and interrupts the turn.
@@ -4021,7 +3958,9 @@ describe("call-controller", () => {
       };
 
       const turnPromise = controller.handleCallerUtterance("Hi");
-      for (let i = 0; i < 10; i++) await Promise.resolve();
+      for (let i = 0; i < 10; i++) {
+        await Promise.resolve();
+      }
 
       // Tokens were emitted (buffered by the transport) but no audio has
       // started — the controller must still be processing.
@@ -4077,7 +4016,9 @@ describe("call-controller", () => {
       };
 
       const turnPromise = controller.handleCallerUtterance("Hi");
-      for (let i = 0; i < 10; i++) await Promise.resolve();
+      for (let i = 0; i < 10; i++) {
+        await Promise.resolve();
+      }
       expect(controller.getState()).toBe("processing");
 
       // Transport reports real outbound audio started → speaking.
@@ -4130,7 +4071,9 @@ describe("call-controller", () => {
       };
 
       const turn1 = controller.handleCallerUtterance("Hi");
-      for (let i = 0; i < 10; i++) await Promise.resolve();
+      for (let i = 0; i < 10; i++) {
+        await Promise.resolve();
+      }
       expect(controller.getState()).toBe("processing");
       expect(cancelledPendingSpeech).toBe(0);
 
@@ -4171,7 +4114,9 @@ describe("call-controller", () => {
       };
 
       const turnPromise = controller.handleCallerUtterance("Hi");
-      for (let i = 0; i < 10; i++) await Promise.resolve();
+      for (let i = 0; i < 10; i++) {
+        await Promise.resolve();
+      }
       const staleCallback = audioStartCallback!;
 
       // Supersede the run (hard interrupt), then fire the stale signal.
@@ -4213,7 +4158,9 @@ describe("call-controller", () => {
       const turnPromise = controller.handleCallerUtterance("Hi");
 
       // Let microtasks settle so onTextDelta runs
-      for (let i = 0; i < 10; i++) await Promise.resolve();
+      for (let i = 0; i < 10; i++) {
+        await Promise.resolve();
+      }
 
       expect(controller.getState()).toBe("speaking");
 

package/src/__tests__/call-conversation-messages.test.ts

@@ -1,11 +1,4 @@
-import { beforeEach, describe, expect, mock, test } from "bun:test";
-
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
+import { beforeEach, describe, expect, test } from "bun:test";
 
 import {
   buildCallCompletionMessage,
@@ -51,7 +44,7 @@ function getLatestAssistantText(conversationId: string): string {
   );
   expect(rows.length).toBeGreaterThan(0);
   const latest = rows[rows.length - 1];
-  const parsed = JSON.parse(latest.content) as Array<{
+  const parsed = latest.content as unknown as Array<{
     type: string;
     text?: string;
     surfaceType?: string;