@vellumai/assistant 0.11.0 → 0.11.1-staging.2

package/src/__tests__/filesystem-tools.test.ts

@@ -60,7 +60,9 @@ describe("FileSystemOps symlink handling", () => {
 
     const result = ops.readFileSafe({ path: "link.txt" });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
@@ -73,7 +75,9 @@ describe("FileSystemOps symlink handling", () => {
     const ops = new FileSystemOps(sandboxPolicyFor(boundary));
     const result = ops.readFileSafe({ path: "link.txt" });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.content).toContain("hello");
   });
 
@@ -88,7 +92,9 @@ describe("FileSystemOps symlink handling", () => {
       content: "bad",
     });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
     // The file must NOT have been written to the outside directory
     expect(existsSync(join(outside, "evil.txt"))).toBe(false);
@@ -109,7 +115,9 @@ describe("FileSystemOps symlink handling", () => {
       replaceAll: false,
     });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
     // The outside file must NOT have been modified
     expect(readFileSync(outsideFile, "utf-8")).toBe("original");
@@ -128,7 +136,9 @@ describe("FileSystemOps read offset/limit edge cases", () => {
 
     const result = ops.readFileSafe({ path: "short.txt", offset: 100 });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.content).toBe("");
   });
 
@@ -139,7 +149,9 @@ describe("FileSystemOps read offset/limit edge cases", () => {
 
     const result = ops.readFileSafe({ path: "file.txt", limit: 0 });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.content).toBe("");
   });
 
@@ -150,7 +162,9 @@ describe("FileSystemOps read offset/limit edge cases", () => {
 
     const result = ops.readFileSafe({ path: "file.txt", offset: 1, limit: 1 });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.content).toContain("first");
     expect(result.value.content).not.toContain("second");
   });
@@ -166,7 +180,9 @@ describe("FileSystemOps read offset/limit edge cases", () => {
       limit: 1000,
     });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.content).toContain("a");
     expect(result.value.content).toContain("b");
   });
@@ -178,7 +194,9 @@ describe("FileSystemOps read offset/limit edge cases", () => {
 
     const result = ops.readFileSafe({ path: "file.txt", offset: 3, limit: 2 });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     // Lines should be numbered 3 and 4
     expect(result.value.content).toContain("3");
     expect(result.value.content).toContain("4");
@@ -207,7 +225,9 @@ describe("FileSystemOps edit match methods", () => {
       replaceAll: false,
     });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.matchMethod).toBe("whitespace");
     expect(result.value.similarity).toBe(1);
     expect(result.value.newContent).toContain("bar");
@@ -225,7 +245,9 @@ describe("FileSystemOps edit match methods", () => {
       replaceAll: false,
     });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.matchMethod).toBe("fuzzy");
     expect(result.value.similarity).toBeGreaterThan(0.8);
     expect(result.value.similarity).toBeLessThan(1);
@@ -243,7 +265,9 @@ describe("FileSystemOps edit match methods", () => {
       replaceAll: false,
     });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     // actualOld should be the text as it appeared in the file
     expect(result.value.actualOld).toContain("fooo");
   });
@@ -260,7 +284,9 @@ describe("FileSystemOps write content tracking", () => {
 
     const result = ops.writeFileSafe({ path: "brand-new.txt", content: "new" });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.oldContent).toBe("");
     expect(result.value.isNewFile).toBe(true);
   });
@@ -275,7 +301,9 @@ describe("FileSystemOps write content tracking", () => {
       content: "version 2",
     });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.oldContent).toBe("version 1");
     expect(result.value.newContent).toBe("version 2");
     expect(result.value.isNewFile).toBe(false);
@@ -287,7 +315,9 @@ describe("FileSystemOps write content tracking", () => {
 
     const result = ops.writeFileSafe({ path: "output.txt", content: "data" });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.filePath).toBe(join(dir, "output.txt"));
   });
 });
@@ -371,7 +401,9 @@ describe("FileSystemOps path traversal prevention", () => {
 
     const result = ops.readFileSafe({ path: "/etc/passwd" });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
@@ -384,7 +416,9 @@ describe("FileSystemOps path traversal prevention", () => {
       content: "bad",
     });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
@@ -399,7 +433,9 @@ describe("FileSystemOps path traversal prevention", () => {
       replaceAll: false,
     });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
@@ -410,7 +446,9 @@ describe("FileSystemOps path traversal prevention", () => {
 
     const result = ops.readFileSafe({ path: "sub/../../etc/passwd" });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
@@ -421,7 +459,9 @@ describe("FileSystemOps path traversal prevention", () => {
 
     const result = ops.readFileSafe({ path: join(dir, "inside.txt") });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.content).toContain("safe content");
   });
 });
@@ -455,7 +495,9 @@ describe("FileSystemOps empty file operations", () => {
 
     const result = ops.readFileSafe({ path: "empty.txt" });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     // Empty file still has one "line" (the empty string before any newline)
     expect(result.value.content).toBeDefined();
   });
@@ -466,7 +508,9 @@ describe("FileSystemOps empty file operations", () => {
 
     const result = ops.writeFileSafe({ path: "empty.txt", content: "" });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.isNewFile).toBe(true);
     expect(readFileSync(join(dir, "empty.txt"), "utf-8")).toBe("");
   });
@@ -483,7 +527,9 @@ describe("FileSystemOps empty file operations", () => {
       replaceAll: false,
     });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("MATCH_NOT_FOUND");
   });
 });
@@ -500,7 +546,9 @@ describe("FileSystemOps /workspace path remapping", () => {
 
     const result = ops.readFileSafe({ path: "/workspace/file.txt" });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.content).toContain("workspace content");
   });
 
@@ -513,7 +561,9 @@ describe("FileSystemOps /workspace path remapping", () => {
       content: "remapped",
     });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(existsSync(join(dir, "new.txt"))).toBe(true);
     expect(readFileSync(join(dir, "new.txt"), "utf-8")).toBe("remapped");
   });
@@ -530,7 +580,9 @@ describe("FileSystemOps /workspace path remapping", () => {
       replaceAll: false,
     });
     expect(result.ok).toBe(true);
-    if (!result.ok) return;
+    if (!result.ok) {
+      return;
+    }
     expect(result.value.newContent).toBe("new content");
     expect(readFileSync(join(dir, "file.txt"), "utf-8")).toBe("new content");
   });
@@ -541,7 +593,9 @@ describe("FileSystemOps /workspace path remapping", () => {
 
     const result = ops.readFileSafe({ path: "/workspace/../../../etc/passwd" });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 });
@@ -558,7 +612,9 @@ describe("FileSystemOps custom size limit", () => {
 
     const result = ops.readFileSafe({ path: "big.txt" });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("SIZE_LIMIT_EXCEEDED");
   });
 
@@ -580,7 +636,9 @@ describe("FileSystemOps custom size limit", () => {
       content: "x".repeat(500),
     });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("SIZE_LIMIT_EXCEEDED");
   });
 
@@ -596,7 +654,9 @@ describe("FileSystemOps custom size limit", () => {
       replaceAll: false,
     });
     expect(result.ok).toBe(false);
-    if (result.ok) return;
+    if (result.ok) {
+      return;
+    }
     expect(result.error.code).toBe("SIZE_LIMIT_EXCEEDED");
   });
 

package/src/__tests__/fixtures/mock-chrome-extension.ts

@@ -200,7 +200,9 @@ export function createMockChromeExtension(
     } finally {
       inFlight.delete(frame.requestId);
     }
-    if (abortCtl.signal.aborted) return;
+    if (abortCtl.signal.aborted) {
+      return;
+    }
 
     const body: HostBrowserResultBody = {
       requestId: frame.requestId,
@@ -246,7 +248,9 @@ export function createMockChromeExtension(
     } catch {
       return;
     }
-    if (!parsed || typeof parsed !== "object") return;
+    if (!parsed || typeof parsed !== "object") {
+      return;
+    }
     const frame = parsed as Record<string, unknown>;
     if (frame.type === "host_browser_request") {
       const typed = frame as unknown as HostBrowserRequestFrame;
@@ -293,7 +297,9 @@ export function createMockChromeExtension(
       try {
         while (true) {
           const { done, value } = await reader.read();
-          if (done) break;
+          if (done) {
+            break;
+          }
           buffer += decoder.decode(value, { stream: true });
           // Parse SSE frames: "data: ...\n\n"
           const parts = buffer.split("\n\n");
@@ -401,7 +407,9 @@ export function createMockChromeExtension(
     },
     sendHostBrowserEvent(event) {
       const sock = ws;
-      if (!sock || sock.readyState !== WebSocket.OPEN) return;
+      if (!sock || sock.readyState !== WebSocket.OPEN) {
+        return;
+      }
       sock.send(
         JSON.stringify({
           type: "host_browser_event",
@@ -415,7 +423,9 @@ export function createMockChromeExtension(
     },
     sendSessionInvalidated(event) {
       const sock = ws;
-      if (!sock || sock.readyState !== WebSocket.OPEN) return;
+      if (!sock || sock.readyState !== WebSocket.OPEN) {
+        return;
+      }
       sock.send(
         JSON.stringify({
           type: "host_browser_session_invalidated",
@@ -426,7 +436,9 @@ export function createMockChromeExtension(
     },
     sendRaw(json: string) {
       const sock = ws;
-      if (!sock || sock.readyState !== WebSocket.OPEN) return;
+      if (!sock || sock.readyState !== WebSocket.OPEN) {
+        return;
+      }
       sock.send(json);
     },
   };

package/src/__tests__/fixtures/mock-signup-server.ts

@@ -39,11 +39,15 @@ function generateVerificationCode(): string {
 }
 
 function parseCookies(header: string | null): Record<string, string> {
-  if (!header) return {};
+  if (!header) {
+    return {};
+  }
   const cookies: Record<string, string> = {};
   for (const pair of header.split(";")) {
     const eqIdx = pair.indexOf("=");
-    if (eqIdx === -1) continue;
+    if (eqIdx === -1) {
+      continue;
+    }
     const key = pair.slice(0, eqIdx).trim();
     const value = pair.slice(eqIdx + 1).trim();
     cookies[key] = value;

package/src/__tests__/fuzzy-match-property.test.ts

@@ -58,11 +58,15 @@ describe("fuzzy-match property-based tests", () => {
     fc.assert(
       fc.property(fc.string({ minLength: 3, maxLength: 200 }), (content) => {
         // Pick a non-empty substring from the content
-        if (content.length < 2) return;
+        if (content.length < 2) {
+          return;
+        }
         const start = 0;
         const end = Math.min(content.length, 3);
         const target = content.slice(start, end);
-        if (target.length === 0) return;
+        if (target.length === 0) {
+          return;
+        }
 
         const result = findMatch(content, target);
         expect(result).not.toBeNull();
@@ -80,7 +84,9 @@ describe("fuzzy-match property-based tests", () => {
         fc.string({ minLength: 1, maxLength: 100 }),
         (prefix, target, suffix) => {
           // Avoid cases where target appears in prefix or suffix
-          if (prefix.includes(target) || suffix.includes(target)) return;
+          if (prefix.includes(target) || suffix.includes(target)) {
+            return;
+          }
 
           const content = prefix + target + suffix;
           // Ensure target's first occurrence is exactly at the inserted position,
@@ -104,10 +110,14 @@ describe("fuzzy-match property-based tests", () => {
         fc.string({ minLength: 1, maxLength: 10 }),
         fc.integer({ min: 1, max: 5 }),
         (word, repeats) => {
-          if (word.length === 0) return;
+          if (word.length === 0) {
+            return;
+          }
           // Build content with the word repeated, separated by a delimiter
           const separator = "|||";
-          if (word.includes(separator)) return;
+          if (word.includes(separator)) {
+            return;
+          }
           const content = Array(repeats).fill(word).join(separator);
 
           const results = findAllMatches(content, word);
@@ -198,7 +208,9 @@ describe("fuzzy-match property-based tests", () => {
         }),
         (lines) => {
           const content = lines.join("\n");
-          if (content.length === 0) return;
+          if (content.length === 0) {
+            return;
+          }
 
           const result = findMatch(content, content);
           expect(result).not.toBeNull();

package/src/__tests__/gateway-flag-listener.test.ts

@@ -99,7 +99,9 @@ function createTestServer(): {
     clients.add(socket);
     socket.on("close", () => clients.delete(socket));
     const waiter = clientWaiters.shift();
-    if (waiter) waiter(socket);
+    if (waiter) {
+      waiter(socket);
+    }
   });
 
   return {
@@ -108,7 +110,9 @@ function createTestServer(): {
     emit: (event: string, data?: unknown) => {
       const payload = JSON.stringify({ event, data }) + "\n";
       for (const client of clients) {
-        if (!client.destroyed) client.write(payload);
+        if (!client.destroyed) {
+          client.write(payload);
+        }
       }
     },
     waitForClient: () =>
@@ -143,7 +147,9 @@ describe("gateway-flag-listener", () => {
     stopGatewayFlagListener();
     await new Promise<void>((resolve) => {
       for (const client of testServer.clients) {
-        if (!client.destroyed) client.destroy();
+        if (!client.destroyed) {
+          client.destroy();
+        }
       }
       testServer.server.close(() => resolve());
     });

package/src/__tests__/gateway-only-enforcement.test.ts

@@ -17,11 +17,12 @@ mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
       get: (_target, prop: string) => {
-        if (prop === "child")
+        if (prop === "child") {
           return () =>
             new Proxy({} as Record<string, unknown>, {
               get: () => () => {},
             });
+        }
         return (...args: unknown[]) => {
           if (typeof args[0] === "string") {
             logMessages.push({ level: prop, msg: args[0] });

package/src/__tests__/gateway-only-guard.test.ts

@@ -96,10 +96,18 @@ function filterViolations(
   extraAllowlist?: Set<string>,
 ): string[] {
   return files.filter((f) => {
-    if (isTestFile(f)) return false;
-    if (isGatewayInternal(f)) return false;
-    if (ALLOWLIST.has(f)) return false;
-    if (extraAllowlist?.has(f)) return false;
+    if (isTestFile(f)) {
+      return false;
+    }
+    if (isGatewayInternal(f)) {
+      return false;
+    }
+    if (ALLOWLIST.has(f)) {
+      return false;
+    }
+    if (extraAllowlist?.has(f)) {
+      return false;
+    }
     return true;
   });
 }

package/src/__tests__/gemini-image-service.test.ts

@@ -36,7 +36,9 @@ mock.module("@google/genai", () => ({
       generateContent: async (params: Record<string, unknown>) => {
         lastGenerateParams = params;
         generateCallCount++;
-        if (shouldThrow) throw shouldThrow;
+        if (shouldThrow) {
+          throw shouldThrow;
+        }
         return fakeResponse;
       },
     };

package/src/__tests__/gemini-provider.test.ts

@@ -46,6 +46,7 @@ let fakeChunks: FakeChunk[] = [];
 let lastStreamParams: Record<string, unknown> | null = null;
 let lastConstructorOpts: Record<string, unknown> | null = null;
 let shouldThrow: Error | null = null;
+let listShouldThrow: Error | null = null;
 
 class FakeApiError extends Error {
   status: number;
@@ -64,7 +65,9 @@ mock.module("@google/genai", () => ({
     models = {
       generateContentStream: async (params: Record<string, unknown>) => {
         lastStreamParams = params;
-        if (shouldThrow) throw shouldThrow;
+        if (shouldThrow) {
+          throw shouldThrow;
+        }
 
         return {
           [Symbol.asyncIterator]: async function* () {
@@ -74,6 +77,12 @@ mock.module("@google/genai", () => ({
           },
         };
       },
+      list: async () => {
+        if (listShouldThrow) {
+          throw listShouldThrow;
+        }
+        return { models: [] };
+      },
     };
   },
   ApiError: FakeApiError,
@@ -86,7 +95,10 @@ mock.module("@google/genai", () => ({
 }));
 
 // Import after mocking
-import { GeminiProvider } from "../providers/gemini/client.js";
+import {
+  GeminiProvider,
+  validateGeminiApiKey,
+} from "../providers/gemini/client.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -1472,6 +1484,48 @@ describe("GeminiProvider", () => {
     ).toBe("model_not_found");
   });
 
+  test("maps 404 with empty message to network_error (proxy interception)", async () => {
+    const reason = await reasonForApiError(404, "");
+    expect(reason).toBe("network_error");
+  });
+
+  test("maps 403 with empty message to network_error (proxy interception)", async () => {
+    const reason = await reasonForApiError(403, "");
+    expect(reason).toBe("network_error");
+  });
+
+  test("surfaces actionable network/proxy message for 404 with empty body", async () => {
+    shouldThrow = new FakeApiError(404, "");
+    try {
+      await provider.sendMessage([
+        { role: "user", content: [{ type: "text", text: "Hi" }] },
+      ]);
+      throw new Error("expected sendMessage to throw");
+    } catch (error) {
+      expect(error).toBeInstanceOf(ProviderError);
+      const msg = (error as Error).message;
+      expect(msg).toContain("no response body");
+      expect(msg).toContain("network proxy or egress filter");
+      expect(msg).not.toContain("Gemini API error (404):");
+    }
+  });
+
+  test("preserves existing message format for 404 with a real body", async () => {
+    shouldThrow = new FakeApiError(404, "NOT_FOUND: model does not exist");
+    try {
+      await provider.sendMessage([
+        { role: "user", content: [{ type: "text", text: "Hi" }] },
+      ]);
+      throw new Error("expected sendMessage to throw");
+    } catch (error) {
+      expect(error).toBeInstanceOf(ProviderError);
+      const msg = (error as Error).message;
+      expect(msg).toBe(
+        "Gemini API error (404): NOT_FOUND: model does not exist",
+      );
+    }
+  });
+
   test("maps a plain 429 (no token signal) to rate_limited, not context overflow", async () => {
     shouldThrow = new FakeApiError(
       429,
@@ -1707,3 +1761,28 @@ describe("GeminiProvider", () => {
     });
   });
 });
+
+// ---------------------------------------------------------------------------
+// validateGeminiApiKey — empty-body 403 handling (proxy interception)
+// ---------------------------------------------------------------------------
+describe("validateGeminiApiKey", () => {
+  beforeEach(() => {
+    shouldThrow = null;
+    listShouldThrow = null;
+  });
+
+  test("returns valid for 403 with empty message (proxy interception)", async () => {
+    listShouldThrow = new FakeApiError(403, "");
+    const result = await validateGeminiApiKey("test-key");
+    expect(result.valid).toBe(true);
+  });
+
+  test("returns invalid for 403 with a real message", async () => {
+    listShouldThrow = new FakeApiError(403, "PERMISSION_DENIED");
+    const result = await validateGeminiApiKey("test-key");
+    expect(result.valid).toBe(false);
+    if (!result.valid) {
+      expect(result.reason).toContain("Gemini API error (403)");
+    }
+  });
+});