@vellumai/assistant 0.10.9 → 0.10.10-dev.202607162206.d08e98e

package/src/cli/commands/__tests__/inference-providers.test.ts

@@ -1,14 +1,16 @@
 /**
- * Tests for `assistant inference providers connections` CLI arg parsing / IPC
- * wiring — focused on the openai-compatible `--base-url` / `--model` flags that
- * forward to the connection route's `base_url` + `models` fields.
+ * Tests for `assistant inference providers` CLI arg parsing / IPC wiring —
+ * the provider-first verbs (auth derived from the provider, explicit --auth
+ * as an override), the openai-compatible `--base-url` / `--model` flags that
+ * forward to the connection route's `base_url` + `models` fields, and the
+ * deprecated `providers connections` alias.
  */
 
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { Command } from "commander";
 
-let lastIpcCall: { method: string; params?: any } | null = null;
+let ipcCalls: { method: string; params?: any }[] = [];
 let mockIpcResult: { ok: boolean; result?: unknown; error?: string } = {
   ok: true,
   result: {},
@@ -16,7 +18,7 @@ let mockIpcResult: { ok: boolean; result?: unknown; error?: string } = {
 
 mock.module("../../../ipc/cli-client.js", () => ({
   cliIpcCall: async (method: string, params?: Record<string, unknown>) => {
-    lastIpcCall = { method, params };
+    ipcCalls.push({ method, params });
     return mockIpcResult;
   },
 }));
@@ -40,8 +42,12 @@ const CONNECTION_RESULT = {
   updatedAt: Date.now(),
 };
 
+function lastIpcCall(): { method: string; params?: any } | null {
+  return ipcCalls[ipcCalls.length - 1] ?? null;
+}
+
 beforeEach(() => {
-  lastIpcCall = null;
+  ipcCalls = [];
   mockIpcResult = { ok: true, result: CONNECTION_RESULT };
   process.exitCode = 0;
 });
@@ -80,11 +86,74 @@ async function run(
   return { stdout, exitCode };
 }
 
-describe("providers connections create — openai-compatible", () => {
+describe("providers create — derived auth", () => {
+  test("derives api_key auth from --credential for a keyed provider", async () => {
+    await run([
+      "providers",
+      "create",
+      "anthropic-personal",
+      "--provider",
+      "anthropic",
+      "--credential",
+      "credential/anthropic/api_key",
+    ]);
+    expect(lastIpcCall()?.method).toBe("inference_provider_connections_create");
+    expect(lastIpcCall()?.params?.body).toEqual({
+      name: "anthropic-personal",
+      provider: "anthropic",
+      auth: { type: "api_key", credential: "credential/anthropic/api_key" },
+    });
+  });
+
+  test("derives none auth for a keyless provider (ollama)", async () => {
+    await run([
+      "providers",
+      "create",
+      "ollama-personal",
+      "--provider",
+      "ollama",
+    ]);
+    expect(lastIpcCall()?.params?.body).toEqual({
+      name: "ollama-personal",
+      provider: "ollama",
+      auth: { type: "none" },
+    });
+  });
+
+  test("rejects a keyed provider without --credential before calling the daemon", async () => {
+    const { exitCode } = await run([
+      "providers",
+      "create",
+      "anthropic-personal",
+      "--provider",
+      "anthropic",
+    ]);
+    expect(exitCode).toBe(1);
+    expect(lastIpcCall()).toBeNull();
+  });
+
+  test("an explicit --auth override wins over derivation", async () => {
+    await run([
+      "providers",
+      "create",
+      "managed-anthropic",
+      "--provider",
+      "anthropic",
+      "--auth",
+      "platform",
+    ]);
+    expect(lastIpcCall()?.params?.body).toEqual({
+      name: "managed-anthropic",
+      provider: "anthropic",
+      auth: { type: "platform" },
+    });
+  });
+});
+
+describe("providers create — openai-compatible", () => {
   test("forwards base_url and collected --model list to the route", async () => {
     await run([
       "providers",
-      "connections",
       "create",
       "local-llm",
       "--provider",
@@ -98,8 +167,8 @@ describe("providers connections create — openai-compatible", () => {
       "--model",
       "model-b",
     ]);
-    expect(lastIpcCall?.method).toBe("inference_provider_connections_create");
-    expect(lastIpcCall?.params?.body).toEqual({
+    expect(lastIpcCall()?.method).toBe("inference_provider_connections_create");
+    expect(lastIpcCall()?.params?.body).toEqual({
       name: "local-llm",
       provider: "openai-compatible",
       auth: { type: "none" },
@@ -108,10 +177,49 @@ describe("providers connections create — openai-compatible", () => {
     });
   });
 
+  test("openai-compatible without --credential derives none auth (local endpoints)", async () => {
+    await run([
+      "providers",
+      "create",
+      "local-llm",
+      "--provider",
+      "openai-compatible",
+      "--base-url",
+      "http://localhost:1234/v1",
+      "--model",
+      "model-a",
+    ]);
+    expect(lastIpcCall()?.params?.body).toEqual({
+      name: "local-llm",
+      provider: "openai-compatible",
+      auth: { type: "none" },
+      base_url: "http://localhost:1234/v1",
+      models: [{ id: "model-a" }],
+    });
+  });
+
+  test("openai-compatible with --credential derives api_key auth", async () => {
+    await run([
+      "providers",
+      "create",
+      "hosted-llm",
+      "--provider",
+      "openai-compatible",
+      "--credential",
+      "credential/hosted/key",
+      "--base-url",
+      "https://api.example.com/v1",
+      "--model",
+      "model-a",
+    ]);
+    expect(lastIpcCall()?.params?.body).toMatchObject({
+      auth: { type: "api_key", credential: "credential/hosted/key" },
+    });
+  });
+
   test("rejects openai-compatible without --base-url before calling the daemon", async () => {
     const { exitCode } = await run([
       "providers",
-      "connections",
       "create",
       "local-llm",
       "--provider",
@@ -122,47 +230,81 @@ describe("providers connections create — openai-compatible", () => {
       "model-a",
     ]);
     expect(exitCode).toBe(1);
-    expect(lastIpcCall).toBeNull();
+    expect(lastIpcCall()).toBeNull();
   });
+});
 
-  test("omits base_url/models for a standard provider", async () => {
+describe("providers update", () => {
+  test("a bare --credential rotates via derived api_key auth", async () => {
+    mockIpcResult = {
+      ok: true,
+      result: {
+        ...CONNECTION_RESULT,
+        name: "anthropic-personal",
+        provider: "anthropic",
+        auth: { type: "api_key", credential: "credential/anthropic/old_key" },
+      },
+    };
     await run([
       "providers",
-      "connections",
-      "create",
+      "update",
       "anthropic-personal",
-      "--provider",
-      "anthropic",
-      "--auth",
-      "api_key",
       "--credential",
-      "credential/anthropic/api_key",
+      "credential/anthropic/new_key",
     ]);
-    expect(lastIpcCall?.params?.body).toEqual({
-      name: "anthropic-personal",
-      provider: "anthropic",
-      auth: { type: "api_key", credential: "credential/anthropic/api_key" },
+    expect(ipcCalls.map((c) => c.method)).toEqual([
+      "inference_provider_connections_get",
+      "inference_provider_connections_update",
+    ]);
+    expect(lastIpcCall()?.params).toEqual({
+      pathParams: { name: "anthropic-personal" },
+      body: {
+        auth: { type: "api_key", credential: "credential/anthropic/new_key" },
+      },
     });
   });
-});
 
-describe("providers connections update — openai-compatible", () => {
-  test("forwards base_url and models alongside auth", async () => {
-    mockIpcResult = { ok: true, result: CONNECTION_RESULT };
+  test("a bare --credential refuses to rotate subscription auth", async () => {
+    mockIpcResult = {
+      ok: true,
+      result: {
+        ...CONNECTION_RESULT,
+        name: "chatgpt-subscription",
+        provider: "openai",
+        auth: {
+          type: "oauth_subscription",
+          credential: "credential/chatgpt/access_token",
+        },
+      },
+    };
+    const { exitCode } = await run([
+      "providers",
+      "update",
+      "chatgpt-subscription",
+      "--credential",
+      "credential/other",
+    ]);
+    expect(exitCode).toBe(1);
+    expect(ipcCalls.map((c) => c.method)).toEqual([
+      "inference_provider_connections_get",
+    ]);
+  });
+
+  test("with no auth flags, re-sends the stored auth (GET first)", async () => {
     await run([
       "providers",
-      "connections",
       "update",
       "local-llm",
-      "--auth",
-      "none",
       "--base-url",
       "http://localhost:5678/v1",
       "--model",
       "model-c",
     ]);
-    expect(lastIpcCall?.method).toBe("inference_provider_connections_update");
-    expect(lastIpcCall?.params).toEqual({
+    expect(ipcCalls.map((c) => c.method)).toEqual([
+      "inference_provider_connections_get",
+      "inference_provider_connections_update",
+    ]);
+    expect(lastIpcCall()?.params).toEqual({
       pathParams: { name: "local-llm" },
       body: {
         auth: { type: "none" },
@@ -171,4 +313,99 @@ describe("providers connections update — openai-compatible", () => {
       },
     });
   });
+
+  test("an explicit --auth override forwards verbatim", async () => {
+    await run([
+      "providers",
+      "update",
+      "local-llm",
+      "--auth",
+      "none",
+      "--base-url",
+      "http://localhost:5678/v1",
+    ]);
+    expect(ipcCalls.map((c) => c.method)).toEqual([
+      "inference_provider_connections_update",
+    ]);
+    expect(lastIpcCall()?.params?.body).toEqual({
+      auth: { type: "none" },
+      base_url: "http://localhost:5678/v1",
+    });
+  });
+});
+
+describe("providers list output", () => {
+  test("shows providers without auth details", async () => {
+    mockIpcResult = {
+      ok: true,
+      result: {
+        connections: [
+          {
+            name: "vellum",
+            provider: "vellum",
+            auth: { type: "platform" },
+          },
+          {
+            name: "anthropic-personal",
+            provider: "anthropic",
+            auth: { type: "api_key", credential: "credential/anthropic/x" },
+          },
+        ],
+      },
+    };
+    const { stdout } = await run(["providers", "list"]);
+    expect(stdout).toContain("vellum  provider=vellum");
+    expect(stdout).toContain("anthropic-personal  provider=anthropic");
+    expect(stdout).not.toContain("auth=");
+    expect(stdout).not.toContain("api_key");
+  });
+
+  test("--json output keeps the full wire shape including auth", async () => {
+    mockIpcResult = {
+      ok: true,
+      result: {
+        connections: [
+          {
+            name: "anthropic-personal",
+            provider: "anthropic",
+            auth: { type: "api_key", credential: "credential/anthropic/x" },
+          },
+        ],
+      },
+    };
+    const { stdout } = await run(["providers", "list", "--json"]);
+    const parsed = JSON.parse(stdout);
+    expect(parsed.connections[0].auth).toEqual({
+      type: "api_key",
+      credential: "credential/anthropic/x",
+    });
+  });
+});
+
+describe("deprecated providers connections alias", () => {
+  test("connections create still forwards to the same route", async () => {
+    await run([
+      "providers",
+      "connections",
+      "create",
+      "anthropic-personal",
+      "--provider",
+      "anthropic",
+      "--credential",
+      "credential/anthropic/api_key",
+    ]);
+    expect(lastIpcCall()?.method).toBe("inference_provider_connections_create");
+    expect(lastIpcCall()?.params?.body).toEqual({
+      name: "anthropic-personal",
+      provider: "anthropic",
+      auth: { type: "api_key", credential: "credential/anthropic/api_key" },
+    });
+  });
+
+  test("connections list forwards to the same route", async () => {
+    mockIpcResult = { ok: true, result: { connections: [] } };
+    const { stdout } = await run(["providers", "connections", "list"]);
+    expect(lastIpcCall()?.method).toBe("inference_provider_connections_list");
+    expect(stdout).toContain("No providers found.");
+  });
 });

package/src/cli/commands/__tests__/notifications.test.ts

@@ -29,9 +29,15 @@ let ipcResponse: {
 };
 
 const exitCodeFromIpcResult = (r: { statusCode?: number }): number => {
-  if (r.statusCode === undefined) return 10;
-  if (r.statusCode >= 500) return 3;
-  if (r.statusCode >= 400) return 2;
+  if (r.statusCode === undefined) {
+    return 10;
+  }
+  if (r.statusCode >= 500) {
+    return 3;
+  }
+  if (r.statusCode >= 400) {
+    return 2;
+  }
   return 1;
 };
 
@@ -518,6 +524,21 @@ describe("notifications list", () => {
     expect(ipcCalls[0].method).toBe("list_home_feed");
   });
 
+  test("list help disambiguates Vellum notifications from email inboxes", async () => {
+    const { stdout, exitCode } = await runRawCommand([
+      "notifications",
+      "list",
+      "--help",
+    ]);
+
+    expect(exitCode).toBe(0);
+    const normalizedHelp = stdout.replace(/\s+/g, " ");
+    expect(normalizedHelp).toContain("Vellum Home feed");
+    expect(normalizedHelp).toContain("does not read email inboxes");
+    expect(normalizedHelp).toContain("Gmail");
+    expect(normalizedHelp).toContain("Outlook");
+  });
+
   test("list returns items from IPC", async () => {
     ipcResponse = {
       ok: true,

package/src/cli/commands/config.help.ts

@@ -19,9 +19,9 @@ and "assistant keys set <provider> <key>" to view and manage API keys.
 
 Examples:
   $ assistant config list
-  $ assistant config get llm.default.provider
+  $ assistant config get llm.defaultProvider.provider
   $ assistant config schema services
-  $ assistant config set llm.default.provider anthropic
+  $ assistant config set llm.defaultProvider.provider anthropic
   $ assistant config set calls.enabled true`,
   subcommands: [
     {
@@ -31,7 +31,7 @@ Examples:
         "Set a config value (supports dotted paths like calls.enabled)",
       helpText: `
 Arguments:
-  key     Dotted path to the config key (e.g. llm.default.provider,
+  key     Dotted path to the config key (e.g. llm.defaultProvider.provider,
           calls.enabled, twilio.accountSid). Intermediate objects are created
           automatically.
   value   The value to store. Parsed as JSON first (so "true" becomes boolean
@@ -46,7 +46,7 @@ explicit null is preserved.
 To manage API keys, use "assistant keys set <provider> <key>" instead.
 
 Examples:
-  $ assistant config set llm.default.provider anthropic
+  $ assistant config set llm.defaultProvider.provider anthropic
   $ assistant config set calls.enabled true`,
     },
     {
@@ -55,7 +55,7 @@ Examples:
       description: "Get a config value (supports dotted paths)",
       helpText: `
 Arguments:
-  key   Dotted path to the config key (e.g. llm.default.provider,
+  key   Dotted path to the config key (e.g. llm.defaultProvider.provider,
         calls.enabled)
 
 Fetches the full config from the assistant and prints the value at the
@@ -65,7 +65,7 @@ values are pretty-printed as indented JSON.
 To view API keys, use "assistant keys list" instead.
 
 Examples:
-  $ assistant config get llm.default.provider
+  $ assistant config get llm.defaultProvider.provider
   $ assistant config get calls.enabled`,
     },
     {

package/src/cli/commands/credentials.help.ts

@@ -191,6 +191,11 @@ Examples:
           flags: "--field <field>",
           description: "Field name",
         },
+        {
+          flags: "--for-chat",
+          description:
+            "Print a chat-safe reveal chip token instead of the plaintext",
+        },
       ],
       helpText: `
 Arguments:
@@ -204,10 +209,18 @@ captured with shell substitution.
 Use --service and --field to look up by service/field, or pass a UUID as a
 positional argument. One of the two forms is required.
 
+With --for-chat, the plaintext is never printed: the command outputs the
+credential's redaction chip token instead. Paste that token into a chat
+reply to show the credential as a click-to-reveal chip — use it whenever
+the goal is to SHOW a credential to the user in conversation rather than
+to pipe its value into another tool. Requires the chat-credential-reveal
+feature flag.
+
 Examples:
   $ assistant credentials reveal --service twilio --field auth_token
   $ assistant credentials reveal 7a3b1c2d-4e5f-6789-abcd-ef0123456789
   $ assistant credentials reveal --json --service twilio --field account_sid
+  $ assistant credentials reveal --for-chat --service twilio --field auth_token
   $ export TWILIO_TOKEN=$(assistant credentials reveal --service twilio --field auth_token)`,
     },
     {

package/src/cli/commands/credentials.ts

@@ -359,7 +359,7 @@ export function registerCredentialsCommand(program: Command): void {
       subcommand(credential, "reveal").action(
         async (
           id: string | undefined,
-          opts: { service?: string; field?: string },
+          opts: { service?: string; field?: string; forChat?: boolean },
           cmd: Command,
         ) => {
           if (!opts.service && !opts.field && !id) {
@@ -376,6 +376,11 @@ export function registerCredentialsCommand(program: Command): void {
               service: opts.service,
               field: opts.field,
               id,
+              ...(opts.forChat ? { forChat: true } : {}),
+              // Conversation-bound authority scope for the daemon's chat
+              // redaction seams (set by the shell tools; absent outside a
+              // conversation's tool shell, where no authority should exist).
+              revealNonce: process.env.__REVEAL_NONCE,
             },
           });
 

package/src/cli/commands/email.help.ts

@@ -94,6 +94,10 @@ Examples:
         { flags: "--html <path>", description: "HTML body file (optional)" },
         { flags: "--cc <address>", description: "CC recipient (repeatable)" },
         { flags: "--bcc <address>", description: "BCC recipient (repeatable)" },
+        {
+          flags: "--attach <path>",
+          description: "File to attach (repeatable)",
+        },
         {
           flags: "--reply-to <email_id>",
           description:
@@ -127,6 +131,9 @@ Examples:
   $ assistant email send user@example.com -b "Thanks!" --reply-to 019d96e4-e5d2-7201-890e-04a21e8f95bb
   ✓ Sent to user@example.com (delivery_id: ghi789)
 
+  $ assistant email send user@example.com -s "Report" -b "Attached" --attach report.pdf --attach data.csv
+  ✓ Sent to user@example.com (delivery_id: jkl012)
+
   $ assistant email send user@example.com -s "Hello" -b "Hi" --json
   {"delivery_id":"abc123","status":"accepted"}`,
     },

package/src/cli/commands/email.ts

@@ -14,6 +14,7 @@ import {
   cliIpcCallStream,
   exitFromIpcResult,
 } from "../../ipc/cli-client.js";
+import { guessMimeType } from "../../util/mime-type.js";
 import { readStdinSync } from "../../util/read-stdin.js";
 import { applyCommandHelp, subcommand } from "../lib/cli-command-help.js";
 import { registerCommand } from "../lib/register-command.js";
@@ -402,7 +403,11 @@ Examples:
       // imperatively to the declaratively-registered options.
       const send = subcommand(email, "send");
       const collect = (val: string, prev: string[]) => [...prev, val];
-      for (const flags of ["--cc <address>", "--bcc <address>"]) {
+      for (const flags of [
+        "--cc <address>",
+        "--bcc <address>",
+        "--attach <path>",
+      ]) {
         const option = send.options.find((o) => o.flags === flags);
         if (!option) {
           throw new Error(
@@ -422,6 +427,7 @@ Examples:
             html?: string;
             cc?: string[];
             bcc?: string[];
+            attach?: string[];
             replyTo?: string;
           },
           cmd: Command,
@@ -472,6 +478,31 @@ Examples:
             }
           }
 
+          // Read attachments and base64-encode their content for the JSON
+          // wire to the platform proxy.
+          let attachments:
+            | { filename: string; content_type: string; content: string }[]
+            | undefined;
+          if (opts.attach && opts.attach.length > 0) {
+            attachments = [];
+            for (const path of opts.attach) {
+              try {
+                const data = readFileSync(path);
+                attachments.push({
+                  filename: basename(path),
+                  content_type: guessMimeType(path),
+                  content: data.toString("base64"),
+                });
+              } catch (err) {
+                log.error(
+                  `Failed to read --attach ${path}: ${err instanceof Error ? err.message : String(err)}`,
+                );
+                process.exitCode = 1;
+                return;
+              }
+            }
+          }
+
           const params: Record<string, unknown> = { to, text };
           if (opts.subject) {
             params.subject = opts.subject;
@@ -485,6 +516,9 @@ Examples:
           if (opts.bcc && opts.bcc.length > 0) {
             params.bcc = opts.bcc;
           }
+          if (attachments && attachments.length > 0) {
+            params.attachments = attachments;
+          }
           if (opts.replyTo) {
             params.reply_to = opts.replyTo;
           }