@vellumai/assistant 0.11.10 → 0.11.11-staging.1

package/src/__tests__/notification-events-source-context-probe.test.ts

@@ -0,0 +1,211 @@
+/**
+ * Tests for `hasNotifiedSourceContextSince`, the probe the schedule-result
+ * producer uses to ask "did this run already notify?".
+ *
+ * Two things are worth pinning down. The `since` bound: a recurring schedule
+ * with `reuseConversation` runs every firing in the same conversation, so an
+ * unbounded probe would find run #1's notification forever and silence every
+ * run after it. And the outcome test: `emitNotificationSignal` persists the
+ * event before the pipeline can fail, so an event row alone proves an attempt,
+ * not a notification — counting it would suppress the fallback in exactly the
+ * case it exists for.
+ */
+
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import { eq } from "drizzle-orm";
+
+import { createDecision } from "../notifications/decisions-store.js";
+import { createDelivery } from "../notifications/deliveries-store.js";
+import {
+  createEvent,
+  hasNotifiedSourceContextSince,
+} from "../notifications/events-store.js";
+import type { NotificationDeliveryStatus } from "../notifications/types.js";
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+import {
+  notificationDecisions,
+  notificationDeliveries,
+  notificationEvents,
+} from "../persistence/schema/index.js";
+
+await initializeDb();
+
+const CONVERSATION_ID = "conv-schedule-run";
+
+beforeEach(() => {
+  getDb().delete(notificationDeliveries).run();
+  getDb().delete(notificationDecisions).run();
+  getDb().delete(notificationEvents).run();
+});
+
+/**
+ * How far the seeded signal got through the pipeline.
+ *
+ * - `no-verdict`: the event row exists and nothing else — the pipeline threw
+ *   before the decision stage.
+ * - `declined`: the engine decided not to notify.
+ * - a delivery status: the engine said notify and dispatch recorded a delivery
+ *   in that state.
+ */
+type SeedOutcome = "no-verdict" | "declined" | NotificationDeliveryStatus;
+
+/**
+ * Seed a signal and backdate its event: `createEvent` stamps `Date.now()`, but
+ * the `since` cases turn entirely on where a row sits relative to a run's start.
+ */
+function seedSignalAt(
+  sourceContextId: string,
+  createdAt: number,
+  outcome: SeedOutcome = "sent",
+): void {
+  const eventId = crypto.randomUUID();
+  createEvent({
+    id: eventId,
+    sourceEventName: "assistant.share",
+    sourceChannel: "assistant_tool",
+    sourceContextId,
+    attentionHints: {
+      requiresAction: false,
+      urgency: "low",
+      isAsyncBackground: true,
+      visibleInSourceNow: false,
+    },
+    payload: { requestedMessage: "sent by the run itself" },
+  });
+  getDb()
+    .update(notificationEvents)
+    .set({ createdAt })
+    .where(eq(notificationEvents.id, eventId))
+    .run();
+
+  if (outcome === "no-verdict") {
+    return;
+  }
+  const decision = createDecision({
+    id: crypto.randomUUID(),
+    notificationEventId: eventId,
+    shouldNotify: outcome !== "declined",
+    selectedChannels: outcome === "declined" ? [] : ["vellum"],
+    reasoningSummary: "test",
+    confidence: 1,
+    fallbackUsed: false,
+  });
+  if (outcome === "declined") {
+    return;
+  }
+  createDelivery({
+    id: crypto.randomUUID(),
+    notificationDecisionId: decision.id,
+    channel: "vellum",
+    destination: "vellum",
+    status: outcome,
+    attempt: 1,
+  });
+}
+
+describe("hasNotifiedSourceContextSince", () => {
+  const runStartedAt = 1_700_000_000_000;
+
+  describe("the since bound", () => {
+    test("finds a notification sent during the run", () => {
+      seedSignalAt(CONVERSATION_ID, runStartedAt + 500);
+
+      expect(hasNotifiedSourceContextSince(CONVERSATION_ID, runStartedAt)).toBe(
+        true,
+      );
+    });
+
+    test("ignores a notification from a prior run in the same conversation", () => {
+      // The reused-conversation case: yesterday's firing notified, today's did
+      // not. Today's run still owes the user a notification.
+      const todaysRunStartedAt = runStartedAt + 86_400_000;
+      seedSignalAt(CONVERSATION_ID, runStartedAt + 500);
+
+      expect(
+        hasNotifiedSourceContextSince(CONVERSATION_ID, todaysRunStartedAt),
+      ).toBe(false);
+    });
+
+    test("counts a notification landing exactly at the run's start", () => {
+      // The bound is inclusive: a notification stamped in the same millisecond
+      // the run began belongs to that run.
+      seedSignalAt(CONVERSATION_ID, runStartedAt);
+
+      expect(hasNotifiedSourceContextSince(CONVERSATION_ID, runStartedAt)).toBe(
+        true,
+      );
+    });
+
+    test("ignores a notification from a different conversation", () => {
+      seedSignalAt("some-other-conversation", runStartedAt + 500);
+
+      expect(hasNotifiedSourceContextSince(CONVERSATION_ID, runStartedAt)).toBe(
+        false,
+      );
+    });
+
+    test("returns false when nothing was ever emitted", () => {
+      expect(hasNotifiedSourceContextSince(CONVERSATION_ID, runStartedAt)).toBe(
+        false,
+      );
+    });
+  });
+
+  describe("the outcome test", () => {
+    test("ignores an event whose pipeline never reached a verdict", () => {
+      // The audit row of an emit that threw before the decision stage. Nobody
+      // was told, so the run still owes its notification.
+      seedSignalAt(CONVERSATION_ID, runStartedAt + 500, "no-verdict");
+
+      expect(hasNotifiedSourceContextSince(CONVERSATION_ID, runStartedAt)).toBe(
+        false,
+      );
+    });
+
+    test("ignores an event whose only delivery failed", () => {
+      seedSignalAt(CONVERSATION_ID, runStartedAt + 500, "failed");
+
+      expect(hasNotifiedSourceContextSince(CONVERSATION_ID, runStartedAt)).toBe(
+        false,
+      );
+    });
+
+    test("ignores an event whose only delivery was skipped", () => {
+      seedSignalAt(CONVERSATION_ID, runStartedAt + 500, "skipped");
+
+      expect(hasNotifiedSourceContextSince(CONVERSATION_ID, runStartedAt)).toBe(
+        false,
+      );
+    });
+
+    test("counts a delivery still pending", () => {
+      // Something is on its way; the fallback must not race it.
+      seedSignalAt(CONVERSATION_ID, runStartedAt + 500, "pending");
+
+      expect(hasNotifiedSourceContextSince(CONVERSATION_ID, runStartedAt)).toBe(
+        true,
+      );
+    });
+
+    test("counts a decision not to notify", () => {
+      // The engine ruled on the run's own signal. The fallback covers runs that
+      // never asked; it does not appeal verdicts the user's settings produced.
+      seedSignalAt(CONVERSATION_ID, runStartedAt + 500, "declined");
+
+      expect(hasNotifiedSourceContextSince(CONVERSATION_ID, runStartedAt)).toBe(
+        true,
+      );
+    });
+
+    test("one delivered signal among failed ones is enough", () => {
+      seedSignalAt(CONVERSATION_ID, runStartedAt + 100, "failed");
+      seedSignalAt(CONVERSATION_ID, runStartedAt + 200, "sent");
+
+      expect(hasNotifiedSourceContextSince(CONVERSATION_ID, runStartedAt)).toBe(
+        true,
+      );
+    });
+  });
+});

package/src/__tests__/openai-responses-prompt-cache.test.ts

@@ -1,9 +1,10 @@
 /**
  * Prompt caching on the OpenAI Responses transport: request-wide
- * `prompt_cache_key` emission for every direct-API model (routing affinity for
- * implicit-mode models, opt-in explicit mode for breakpoint-capable ones),
- * explicit `prompt_cache_options` and block-level `prompt_cache_breakpoint`
- * anchor placement for GPT-5.6+ (turn-start / previous-turn / advancing tail,
+ * `prompt_cache_key` emission for every Responses model (routing affinity for
+ * implicit-mode models, including the Codex subscription endpoint; opt-in
+ * explicit mode for breakpoint-capable direct-API models), explicit
+ * `prompt_cache_options` and block-level `prompt_cache_breakpoint` anchor
+ * placement for GPT-5.6+ (turn-start / previous-turn / advancing tail,
  * mirroring the Anthropic client), the `disableCache`
  * explicit-mode-with-zero-markers opt-out, and the unflagged-model and Codex
  * regression guards.
@@ -389,19 +390,52 @@ describe("OpenAIResponsesProvider explicit prompt caching (GPT-5.6+)", () => {
     expect(breakpointedItemIndexes()).toEqual([0]);
   });
 
-  test("codex subscription endpoint gets no cache params", async () => {
+  test("codex subscription endpoint sends prompt_cache_key but no explicit-mode params", async () => {
     const provider = makeProvider("gpt-5.6-sol", true);
     await provider.sendMessage([userMsg("hi")], {
       config: { promptCacheKey: "conv-1" },
     });
 
+    // Codex uses implicit prefix caching. The key is a supported routing
+    // field (same as the official Codex client); prompt_cache_options,
+    // breakpoints, and prompt_cache_retention are not.
+    expect(lastStreamParams?.prompt_cache_key).toBe("conv-1");
     expect(lastStreamParams?.prompt_cache_options).toBeUndefined();
-    expect(lastStreamParams?.prompt_cache_key).toBeUndefined();
+    expect(lastStreamParams?.prompt_cache_retention).toBeUndefined();
+    expect(JSON.stringify(lastStreamParams?.input)).not.toContain(
+      "prompt_cache_breakpoint",
+    );
+  });
+
+  test("codex subscription endpoint keeps prompt_cache_key stable across append-only turns", async () => {
+    const provider = makeProvider("gpt-5.6-sol", true);
+    await provider.sendMessage([userMsg("hi")], {
+      config: { promptCacheKey: "conv-1" },
+    });
+    expect(lastStreamParams?.prompt_cache_key).toBe("conv-1");
+
+    await provider.sendMessage(
+      [userMsg("hi"), assistantMsg("ok"), userMsg("again")],
+      { config: { promptCacheKey: "conv-1" } },
+    );
+
+    expect(lastStreamParams?.prompt_cache_key).toBe("conv-1");
+    expect(lastStreamParams?.prompt_cache_options).toBeUndefined();
+    expect(lastStreamParams?.prompt_cache_retention).toBeUndefined();
     expect(JSON.stringify(lastStreamParams?.input)).not.toContain(
       "prompt_cache_breakpoint",
     );
   });
 
+  test("codex subscription endpoint omits prompt_cache_key when absent", async () => {
+    const provider = makeProvider("gpt-5.6-sol", true);
+    await provider.sendMessage([userMsg("hi")]);
+
+    expect(lastStreamParams?.prompt_cache_key).toBeUndefined();
+    expect(lastStreamParams?.prompt_cache_options).toBeUndefined();
+    expect(lastStreamParams?.prompt_cache_retention).toBeUndefined();
+  });
+
   test("never mutates the caller's messages", async () => {
     const provider = makeProvider("gpt-5.6-sol");
     const messages = [userMsg("t1"), assistantMsg("r1"), userMsg("t2")];

package/src/__tests__/outlook-messaging-provider.test.ts

@@ -148,6 +148,15 @@ mock.module("../messaging/providers/outlook/client.js", () => ({
   getAutoReplySettings: mockGetAutoReplySettings,
   updateAutoReplySettings: mockUpdateAutoReplySettings,
   listMessagesDelta: mockListMessagesDelta,
+  toOutlookFileAttachments: (
+    attachments: Array<{ filename: string; mimeType: string; data: Buffer }>,
+  ) =>
+    attachments.map((att) => ({
+      "@odata.type": "#microsoft.graph.fileAttachment",
+      name: att.filename,
+      contentType: att.mimeType,
+      contentBytes: att.data.toString("base64"),
+    })),
 }));
 
 import { outlookMessagingProvider } from "../messaging/providers/outlook/adapter.js";

package/src/__tests__/provider-catalog-visibility.test.ts

@@ -19,7 +19,7 @@ function makeConfig(): AssistantConfig {
 }
 
 describe("getVisibleProviderCatalog", () => {
-  test("hides Vellum-hosted GPU models unless developer mode is on", () => {
+  test("hides Vellum-hosted GPU models unless hosted inference is on", () => {
     setOverridesForTesting({});
     const hidden = getVisibleProviderCatalog(makeConfig());
     expect(hidden.find((p) => p.id === "vellum")).toBeUndefined();
@@ -29,7 +29,7 @@ describe("getVisibleProviderCatalog", () => {
         .some((m) => m.id === "qwen/qwen3-8b"),
     ).toBe(false);
 
-    setOverridesForTesting({ "settings-developer-nav": true });
+    setOverridesForTesting({ "vellum-hosted-inference": true });
     const visible = getVisibleProviderCatalog(makeConfig());
     const vellum = visible.find((p) => p.id === "vellum");
     expect(vellum).toBeDefined();

package/src/__tests__/schedule-routes.test.ts

@@ -65,10 +65,18 @@ import {
 } from "../persistence/conversation-crud.js";
 import { getDb } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
+import {
+  clearLifecycleQuiesce,
+  setLifecycleQuiesce,
+} from "../persistence/lifecycle-quiesce.js";
 import { recordUsageEvent } from "../persistence/llm-usage-store.js";
 import { rawRun } from "../persistence/raw-query.js";
 import { assistantEventHub } from "../runtime/assistant-event-hub.js";
-import { BadRequestError, NotFoundError } from "../runtime/routes/errors.js";
+import {
+  BadRequestError,
+  ConflictError,
+  NotFoundError,
+} from "../runtime/routes/errors.js";
 import { ROUTES as HEARTBEAT_ROUTES } from "../runtime/routes/heartbeat-routes.js";
 import { ROUTES as SCHEDULE_ROUTES } from "../runtime/routes/schedule-routes.js";
 import type { RouteDefinition } from "../runtime/routes/types.js";
@@ -1670,6 +1678,27 @@ describe("plugin-sourced schedules over routes", () => {
 
       expect(existsSync(RUN_MARKER)).toBe(true);
     });
+
+    test("refuses run-now while a drain quiesce lease is active", async () => {
+      const imperative = await createSchedule({
+        name: "Quiesced script",
+        cronExpression: "* * * * *",
+        message: "",
+        mode: "script",
+        script: `touch ${RUN_MARKER}`,
+      });
+
+      setLifecycleQuiesce();
+      try {
+        await expect(runNow(imperative.id)).rejects.toThrow(ConflictError);
+        await expect(runNow(imperative.id)).rejects.toThrow(
+          "The assistant is shutting down and is not starting new schedule runs.",
+        );
+        expect(existsSync(RUN_MARKER)).toBe(false);
+      } finally {
+        clearLifecycleQuiesce();
+      }
+    });
   });
 });
 

package/src/__tests__/scheduler-result-notification.test.ts

@@ -0,0 +1,209 @@
+/**
+ * Wiring tests for the schedule-result notification: which schedule runs reach
+ * the producer, and with what.
+ *
+ * The producer's own gates (already notified / nothing to say / flag off) are
+ * covered in `notifications/__tests__/schedule-result-producer.test.ts`. What
+ * is checked here is the scheduler's half of the contract, which the producer
+ * cannot verify about itself: that a successful execute-mode run calls it at
+ * all, that a failed run does not, that the other modes are left alone, and
+ * that `runStartedAt` is captured before the run rather than after — the bound
+ * that keeps a reused conversation's earlier notifications from silencing
+ * later runs.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// Stub the shared runner so the execute path is observable without an LLM.
+let runBackgroundJobShouldFail = false;
+mock.module("../runtime/background-job-runner.js", () => ({
+  runBackgroundJob: async (opts: {
+    prompt: string;
+    groupId?: string;
+    conversationType?: "background" | "scheduled";
+    scheduleJobId?: string;
+    onConversationCreated?: (id: string) => void;
+  }) => {
+    const { createConversation } =
+      await import("../persistence/conversation-crud.js");
+    const conv = createConversation({
+      title: "(test stub)",
+      conversationType: opts.conversationType ?? "background",
+      source: "schedule",
+      ...(opts.groupId ? { groupId: opts.groupId } : {}),
+      ...(opts.scheduleJobId ? { scheduleJobId: opts.scheduleJobId } : {}),
+    });
+    opts.onConversationCreated?.(conv.id);
+    if (runBackgroundJobShouldFail) {
+      return {
+        conversationId: conv.id,
+        ok: false,
+        error: new Error("Simulated failure"),
+        errorKind: "exception" as const,
+      };
+    }
+    return { conversationId: conv.id, ok: true };
+  },
+}));
+
+interface CapturedCall {
+  scheduleId: string;
+  scheduleName: string;
+  conversationId: string;
+  runId: string;
+  runStartedAt: number;
+}
+const producerCalls: CapturedCall[] = [];
+mock.module("../notifications/schedule-result-producer.js", () => ({
+  emitScheduleResultNotification: async (params: CapturedCall) => {
+    producerCalls.push(params);
+  },
+}));
+
+// Notify-mode schedules emit through the pipeline; stub it so the mode-scoping
+// test does not need a live notification stack.
+mock.module("../notifications/emit-signal.js", () => ({
+  emitNotificationSignal: async () => ({
+    signalId: "sig-1",
+    deduplicated: false,
+    dispatched: true,
+    reason: "ok",
+    deliveryResults: [],
+  }),
+}));
+
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+import { createSchedule, getScheduleRuns } from "../schedule/schedule-store.js";
+import { runDueSchedulesOnce } from "../schedule/scheduler.js";
+
+await initializeDb();
+
+function getRawDb(): import("bun:sqlite").Database {
+  return (getDb() as unknown as { $client: import("bun:sqlite").Database })
+    .$client;
+}
+
+function forceScheduleDue(scheduleId: string): void {
+  getRawDb().run("UPDATE cron_jobs SET next_run_at = ? WHERE id = ?", [
+    Date.now() - 1000,
+    scheduleId,
+  ]);
+}
+
+describe("schedule result notification wiring", () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.run("DELETE FROM cron_runs");
+    db.run("DELETE FROM cron_jobs");
+    db.run("DELETE FROM messages");
+    db.run("DELETE FROM conversations");
+    producerCalls.length = 0;
+    runBackgroundJobShouldFail = false;
+  });
+
+  test("a successful execute-mode run reaches the producer", async () => {
+    const schedule = await createSchedule({
+      name: "Morning briefing",
+      cronExpression: "0 9 * * *",
+      message: "Summarize my inbox",
+      syntax: "cron",
+      expression: "0 9 * * *",
+    });
+    forceScheduleDue(schedule.id);
+
+    await runDueSchedulesOnce();
+
+    expect(producerCalls).toHaveLength(1);
+    expect(producerCalls[0].scheduleId).toBe(schedule.id);
+    expect(producerCalls[0].scheduleName).toBe("Morning briefing");
+    expect(producerCalls[0].conversationId).toBeTruthy();
+
+    // The producer must be handed the run the scheduler actually recorded, so
+    // its dedupe key names this firing and not some other.
+    const runs = getScheduleRuns(schedule.id);
+    expect(producerCalls[0].runId).toBe(runs[0].id);
+    expect(runs[0].conversationId).toBe(producerCalls[0].conversationId);
+  });
+
+  test("captures runStartedAt before the run, not after", async () => {
+    const before = Date.now();
+    const schedule = await createSchedule({
+      name: "Morning briefing",
+      cronExpression: "0 9 * * *",
+      message: "Summarize my inbox",
+      syntax: "cron",
+      expression: "0 9 * * *",
+    });
+    forceScheduleDue(schedule.id);
+
+    await runDueSchedulesOnce();
+
+    // Stamped at or after the moment this test began and at or before the
+    // run's own reply. A timestamp taken after the run would sit past any
+    // notification the run emitted, so the probe would miss it and every
+    // well-authored schedule would notify twice.
+    const runs = getScheduleRuns(schedule.id);
+    expect(producerCalls[0].runStartedAt).toBeGreaterThanOrEqual(before);
+    expect(producerCalls[0].runStartedAt).toBeLessThanOrEqual(
+      runs[0].startedAt,
+    );
+  });
+
+  test("a failed run does not reach the producer", async () => {
+    // A failure has its own alerting path (the retry policy's exhaustion
+    // alert). Notifying here would pair every failure with a second message
+    // carrying whatever half-finished text the run left behind.
+    runBackgroundJobShouldFail = true;
+    const schedule = await createSchedule({
+      name: "Morning briefing",
+      cronExpression: "0 9 * * *",
+      message: "Summarize my inbox",
+      syntax: "cron",
+      expression: "0 9 * * *",
+    });
+    forceScheduleDue(schedule.id);
+
+    await runDueSchedulesOnce();
+
+    expect(getScheduleRuns(schedule.id)[0].status).toBe("error");
+    expect(producerCalls).toHaveLength(0);
+  });
+
+  test("notify-mode schedules are left alone", async () => {
+    // Notify mode already is a notification; the fallback would duplicate it.
+    const schedule = await createSchedule({
+      name: "Drink water",
+      cronExpression: "0 9 * * *",
+      message: "Time to drink water",
+      syntax: "cron",
+      expression: "0 9 * * *",
+      mode: "notify",
+    });
+    forceScheduleDue(schedule.id);
+
+    await runDueSchedulesOnce();
+
+    expect(getScheduleRuns(schedule.id)[0].status).toBe("ok");
+    expect(producerCalls).toHaveLength(0);
+  });
+
+  test("script-mode schedules are left alone", async () => {
+    // No agent turn runs, so there is no reply to carry and nothing the
+    // producer could say.
+    const schedule = await createSchedule({
+      name: "Rotate logs",
+      cronExpression: "0 9 * * *",
+      message: "unused",
+      syntax: "cron",
+      expression: "0 9 * * *",
+      mode: "script",
+      script: "true",
+    });
+    forceScheduleDue(schedule.id);
+
+    await runDueSchedulesOnce();
+
+    expect(producerCalls).toHaveLength(0);
+  });
+});

package/src/__tests__/skills-install-extract.test.ts

@@ -5,6 +5,8 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
 import {
   extractTarToDir,
+  SKILL_DEPENDENCY_INSTALL_ARGS,
+  SkillArchiveError,
   writeSkillFilesToDir,
 } from "../skills/catalog-install.js";
 import { makeTar } from "./helpers/tar-fixtures.js";
@@ -81,6 +83,30 @@ describe("extractTarToDir", () => {
     expect(foundSkillMd).toBe(true);
     expect(readFileSync(join(tempDir, "SKILL.md"), "utf-8")).toBe("# demo\n");
   });
+
+  test("rejects a negative octal size field instead of spinning", () => {
+    const header = Buffer.alloc(512, 0);
+    Buffer.from("SKILL.md\0", "ascii").copy(header, 0);
+    header[156] = "0".charCodeAt(0);
+    // Signed octal in the size field parses to -512 with parseInt(..., 8),
+    // which would cancel the 512-byte header advance and loop forever.
+    Buffer.from("-0000001000\0", "ascii").copy(header, 124);
+    const tar = Buffer.concat([header, Buffer.alloc(1024, 0)]);
+
+    expect(() => extractTarToDir(tar, tempDir)).toThrow(SkillArchiveError);
+    expect(() => extractTarToDir(tar, tempDir)).toThrow(
+      "malformed tar size field",
+    );
+  });
+
+  test("dependency install argv suppresses lifecycle scripts", () => {
+    expect(SKILL_DEPENDENCY_INSTALL_ARGS).toEqual([
+      "install",
+      "--omit=dev",
+      "--ignore-scripts",
+      "--no-save",
+    ]);
+  });
 });
 
 describe("writeSkillFilesToDir", () => {

package/src/__tests__/skills-install-staging.test.ts

@@ -13,7 +13,9 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 // Emits `error` on the returned child so the dependency install's spawn
 // promise rejects with the injected failure.
-const mockSpawn = mock(() => {
+const spawnArgv: string[][] = [];
+const mockSpawn = mock((_cmd: string, args: string[] = []) => {
+  spawnArgv.push(args);
   const child = {
     on(event: string, cb: (arg: unknown) => void) {
       if (event === "error") {
@@ -30,7 +32,10 @@ mock.module("node:child_process", () => ({
 }));
 
 import { loadSkillCatalog } from "../config/skills.js";
-import { installSkillLocally } from "../skills/catalog-install.js";
+import {
+  installSkillLocally,
+  SKILL_DEPENDENCY_INSTALL_ARGS,
+} from "../skills/catalog-install.js";
 import { installExternalSkill } from "../skills/skillssh-registry.js";
 import { makeTar } from "./helpers/tar-fixtures.js";
 
@@ -61,6 +66,7 @@ beforeEach(() => {
   process.env.VELLUM_WORKSPACE_DIR = workspaceDir;
   mkdirSync(join(workspaceDir, "skills"), { recursive: true });
   mockSpawn.mockClear();
+  spawnArgv.length = 0;
 });
 
 afterEach(() => {
@@ -103,6 +109,9 @@ describe("staged skill installs", () => {
       ),
     ).rejects.toThrow("dependency install failed");
 
+    expect(mockSpawn).toHaveBeenCalled();
+    expect(spawnArgv[0]).toEqual([...SKILL_DEPENDENCY_INSTALL_ARGS]);
+
     expect(
       existsSync(join(workspaceDir, "skills", "demo-skill", "SKILL.md")),
     ).toBe(false);

package/src/api/constants/personality-sliders.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  PERSONALITY_AXIS_IDS,
+  PERSONALITY_DIRECTION_AXES,
+  PERSONALITY_SLIDER_DEFAULT,
+  PERSONALITY_SLIDERS_PATH,
+} from "./personality-sliders.js";
+
+describe("personality slider contract", () => {
+  test("sidecar path and default stay centered", () => {
+    expect(PERSONALITY_SLIDERS_PATH).toBe("data/personality-sliders.json");
+    expect(PERSONALITY_SLIDER_DEFAULT).toBe(50);
+  });
+
+  test("every slider axis has a left and right direction pole", () => {
+    expect(PERSONALITY_DIRECTION_AXES.map((axis) => axis.sliderId)).toEqual(
+      Object.values(PERSONALITY_AXIS_IDS),
+    );
+  });
+});