@vellumai/assistant 0.11.2 → 0.11.3-dev.202608080427.92f668a

package/src/__tests__/channel-guardian.test.ts

@@ -137,7 +137,7 @@ import {
   startOutbound,
 } from "../runtime/verification-outbound-actions.js";
 import {
-  composeVerificationTelegram,
+  composeVerificationText,
   GUARDIAN_VERIFY_TEMPLATE_KEYS,
 } from "../runtime/verification-templates.js";
 import { resetDbForTesting } from "./db-test-helpers.js";
@@ -1640,32 +1640,42 @@ describe("outbound verification sessions", () => {
 
   // ── Auto-revoke of prior sessions ──
 
-  test("creating a new outbound session auto-revokes prior pending/awaiting sessions", async () => {
+  test("a second code for the same number revokes the first", async () => {
     const { sessionId: firstId } = await createOutboundSession({
       channel: "phone",
-      expectedPhoneE164: "+15551234567",
-      destinationAddress: "+15551234567",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
+    });
+    const { sessionId: secondId } = await createOutboundSession({
+      channel: "phone",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
     });
 
-    const first = await serviceFindActiveSession("phone");
-    expect(first).not.toBeNull();
-    expect(first!.id).toBe(firstId);
+    // Read by id rather than through the unfiltered lookup: two live
+    // sessions minted in the same millisecond have no defined order, and
+    // what matters here is each row's status, not which one is "latest".
+    expect(getSessionById(firstId)!.status).toBe("revoked");
+    expect(getSessionById(secondId)!.status).toBe("awaiting_response");
+  });
 
-    // Create a second session — first should be revoked
+  test("a code for a different number leaves the first alone", async () => {
+    // Two numbers are two people. Verifying one must not silently kill the
+    // other's code, which they would learn about only by trying to use it
+    // and being told it is "invalid or has expired".
+    const { sessionId: firstId } = await createOutboundSession({
+      channel: "phone",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
+    });
     const { sessionId: secondId } = await createOutboundSession({
       channel: "phone",
-      expectedPhoneE164: "+15559876543",
-      destinationAddress: "+15559876543",
+      expectedPhoneE164: "+15555550102",
+      destinationAddress: "+15555550102",
     });
 
-    const second = await serviceFindActiveSession("phone");
-    expect(second).not.toBeNull();
-    expect(second!.id).toBe(secondId);
-
-    // First session should no longer be findable as active
-    const firstRow = getSessionById(firstId);
-    expect(firstRow).not.toBeNull();
-    expect(firstRow!.status).toBe("revoked");
+    expect(getSessionById(firstId)!.status).toBe("awaiting_response");
+    expect(getSessionById(secondId)!.status).toBe("awaiting_response");
   });
 
   // ── findActiveSession returns correct session ──
@@ -1772,26 +1782,46 @@ describe("outbound verification sessions", () => {
     expect(result.success).toBe(true);
   });
 
-  // ── Voice identity match via expectedExternalUserId ──
+  // ── Voice identity is the number ──
 
-  test("Voice identity match succeeds via expectedExternalUserId", async () => {
+  test("a voice session is redeemed by the number it was sent to", async () => {
+    // Voice knows the caller by one thing, so the consume path receives that
+    // number as both actor axes. Every voice mint records it in both
+    // identity columns, and either way the session is bound to the number.
     const { secret } = await createOutboundSession({
       channel: "phone",
-      expectedExternalUserId: "voice-user-42",
-      expectedPhoneE164: "+15551234567",
-      destinationAddress: "+15551234567",
+      expectedExternalUserId: "+15555550101",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
     });
 
-    // Actor matches expectedExternalUserId
     const result = await validateAndConsumeVerification(
       "phone",
       secret,
-      "voice-user-42",
-      "voice-chat-1",
+      "+15555550101",
+      "+15555550101",
     );
 
     expect(result.success).toBe(true);
   });
+
+  test("a voice session refuses a caller on a different number", async () => {
+    const { secret } = await createOutboundSession({
+      channel: "phone",
+      expectedExternalUserId: "+15555550101",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
+    });
+
+    const result = await validateAndConsumeVerification(
+      "phone",
+      secret,
+      "+15555550102",
+      "+15555550102",
+    );
+
+    expect(result.success).toBe(false);
+  });
 });
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -2344,7 +2374,7 @@ describe("outbound Telegram verification", () => {
   });
 
   test("telegram template does not include verification code in message", async () => {
-    const msg = composeVerificationTelegram(
+    const msg = composeVerificationText(
       GUARDIAN_VERIFY_TEMPLATE_KEYS.TELEGRAM_CHALLENGE_REQUEST,
       { code: "abc123", expiresInMinutes: 10 },
     );
@@ -2353,7 +2383,7 @@ describe("outbound Telegram verification", () => {
   });
 
   test("telegram resend template does not include code and includes (resent) suffix", async () => {
-    const msg = composeVerificationTelegram(
+    const msg = composeVerificationText(
       GUARDIAN_VERIFY_TEMPLATE_KEYS.TELEGRAM_RESEND,
       { code: "xyz789", expiresInMinutes: 5 },
     );
@@ -2363,7 +2393,7 @@ describe("outbound Telegram verification", () => {
   });
 
   test("telegram template includes Vellum assistant prefix", async () => {
-    const msg = composeVerificationTelegram(
+    const msg = composeVerificationText(
       GUARDIAN_VERIFY_TEMPLATE_KEYS.TELEGRAM_CHALLENGE_REQUEST,
       { code: "999999", expiresInMinutes: 10, assistantName: "MyBot" },
     );

package/src/__tests__/channel-readiness-telegram-remote.test.ts

@@ -0,0 +1,154 @@
+/**
+ * The Telegram probe's remote check.
+ *
+ * Local checks establish that credentials exist. That is a different claim
+ * from "messages arrive": a registration that never landed leaves every
+ * credential in place and the channel dark, which is how the readiness
+ * indicator went green on a channel nobody could reach.
+ *
+ * The classification lives in `checkTelegramWebhookHealth`, which already
+ * handles error recency and the managed-versus-self-hosted recovery text.
+ * These tests pin how the probe maps its verdicts across three outcomes, not
+ * two: verified pass, hard failure, and the no-evidence statuses that are
+ * neither. A probe that cannot see the answer must not report a fault, and
+ * must not be counted as proof either.
+ */
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import type { TelegramWebhookHealthResult } from "../telegram/webhook-health.js";
+
+let health: TelegramWebhookHealthResult;
+
+mock.module("../telegram/webhook-health.js", () => ({
+  checkTelegramWebhookHealth: async () => health,
+}));
+
+mock.module("../calls/twilio-rest.js", () => ({
+  hasTwilioCredentials: () => false,
+}));
+mock.module("../calls/twilio-config.js", () => ({
+  resolveTwilioPhoneNumber: () => undefined,
+}));
+mock.module("../runtime/channel-invite-transports/whatsapp.js", () => ({
+  resolveWhatsAppDisplayNumber: () => undefined,
+}));
+
+async function runTelegramRemoteProbe() {
+  const { createReadinessService } =
+    await import("../runtime/channel-readiness-service.js");
+  const service = createReadinessService();
+  return service.getReadiness("telegram", true);
+}
+
+async function deliveryCheck() {
+  const [snapshot] = await runTelegramRemoteProbe();
+  const remote = snapshot.remoteChecks ?? [];
+  const result = remote.find((c) => c.name === "webhook_delivery");
+  if (!result) {
+    throw new Error(
+      `no webhook_delivery check ran; got: ${remote.map((c) => c.name).join(", ") || "(none)"}`,
+    );
+  }
+  return result;
+}
+
+beforeEach(() => {
+  health = { status: "healthy", detail: "ok" };
+});
+
+afterEach(() => {
+  mock.restore();
+});
+
+describe("telegram remote probe (webhook delivery)", () => {
+  test("passes when Telegram reports a healthy webhook", async () => {
+    health = { status: "healthy", detail: "delivering" };
+
+    expect((await deliveryCheck()).passed).toBe(true);
+  });
+
+  test("fails when no webhook is registered, carrying the recovery text", async () => {
+    health = {
+      status: "not_registered",
+      detail: "Telegram has no webhook registered. Contact support.",
+    };
+
+    const result = await deliveryCheck();
+    expect(result.passed).toBe(false);
+    // The detail carries fixPath()'s managed-versus-self-hosted guidance, so
+    // the probe relays it rather than substituting wording of its own.
+    expect(result.message).toBe(health.detail);
+  });
+
+  test("fails when Telegram reports a recent delivery error", async () => {
+    health = {
+      status: "delivery_failing",
+      detail: 'Telegram reported "Connection refused"',
+    };
+
+    const result = await deliveryCheck();
+    expect(result.passed).toBe(false);
+    expect(result.message).toBe(health.detail);
+  });
+
+  test("fails when Telegram holds a webhook this deployment did not register", async () => {
+    // The case last_error_date cannot see: on a quiet channel a stale tunnel
+    // address or another deployment's callback never produces a delivery
+    // error, so before the URL comparison this read as healthy.
+    health = {
+      status: "url_mismatch",
+      detail: "Telegram is registered at a different address",
+      registeredUrl: "https://stale.example/webhooks/telegram",
+      expectedUrl: "https://current.example/webhooks/telegram",
+    };
+
+    const result = await deliveryCheck();
+    expect(result.passed).toBe(false);
+    expect(result.message).toBe(health.detail);
+  });
+
+  // The three indeterminate statuses. Each must satisfy BOTH halves: no fault
+  // reported (so a network blip does not paint a working channel broken), and
+  // not counted as evidence (so nothing can claim delivery from a check that
+  // never established it). Asserting only `passed` would let a regression that
+  // drops `indeterminate` through, which is exactly the false-success this
+  // contract exists to prevent.
+  const indeterminateCases = [
+    ["skipped", "no bot token stored"],
+    ["unknown", "could not reach Telegram"],
+    ["unverified", "no record of registering this webhook"],
+  ] as const;
+
+  for (const [status, detail] of indeterminateCases) {
+    test(`${status} is indeterminate: no fault reported, but not proof of delivery`, async () => {
+      health = { status, detail };
+
+      const result = await deliveryCheck();
+      expect(result.passed).toBe(true);
+      expect(result.indeterminate).toBe(true);
+    });
+  }
+
+  test("an untouched install stays not_configured rather than incomplete", async () => {
+    // setupStatus separates not_configured from incomplete by asking whether
+    // any check passed. Counting an indeterminate check there reported a
+    // workspace with no Telegram credentials at all as half-finished, which is
+    // what routes the Channels UI to the "finish setup" prompt instead of the
+    // normal setup flow.
+    health = { status: "skipped", detail: "no bot token stored" };
+
+    const [snapshot] = await runTelegramRemoteProbe();
+    expect(snapshot.setupStatus).toBe("not_configured");
+    expect(snapshot.ready).toBe(false);
+  });
+
+  test("a verified healthy result is not marked indeterminate", async () => {
+    // Sensitivity check for the cases above: if `indeterminate` were set
+    // unconditionally they would pass while proving nothing.
+    health = { status: "healthy", detail: "registered where we set it" };
+
+    const result = await deliveryCheck();
+    expect(result.passed).toBe(true);
+    expect(result.indeterminate).toBeFalsy();
+  });
+});

package/src/__tests__/channel-setup-panel-ack.test.ts

@@ -12,20 +12,21 @@ import { describe, expect, test } from "bun:test";
 
 import type { OpenPanelEvent } from "../api/events/open-panel.js";
 import type { AssistantEvent } from "../api/index.js";
+import type { Conversation } from "../daemon/conversation.js";
 import {
   createSurfaceMutex,
   handleSurfaceAction,
   openChannelSetupPanel,
-  type SurfaceConversationContext,
   surfaceProxyResolver,
 } from "../daemon/conversation-surfaces.js";
 import type { SurfaceType } from "../daemon/message-protocol.js";
+import { asConversation } from "./helpers/mock-conversation.js";
 
 function makeContext(
   sent: AssistantEvent[] = [],
-  overrides: Partial<SurfaceConversationContext> = {},
-): SurfaceConversationContext {
-  return {
+  overrides: Partial<Conversation> = {},
+): Conversation {
+  return asConversation({
     conversationId: "session-1",
     sendToClient: (msg) => sent.push(msg),
     pendingSurfaceActions: new Map<string, { surfaceType: SurfaceType }>(),
@@ -46,7 +47,7 @@ function makeContext(
     processMessage: async () => "ok",
     withSurface: createSurfaceMutex(),
     ...overrides,
-  };
+  });
 }
 
 function findOpenPanel(sent: AssistantEvent[]): OpenPanelEvent | undefined {

package/src/__tests__/client-os-metadata-persistence.test.ts

@@ -2,14 +2,14 @@
  * Verifies that `persistQueuedMessageBody` stamps the client-reported OS
  * surface into `metadata.client.os` on persisted user messages.
  *
- * The web, iOS, and macOS apps all run the same web renderer and report
+ * Browser, mobile, and desktop apps all run the same web renderer and report
  * `userMessageInterface: "web"` (the transport surface, which host-proxy
  * capability gating keys off), so `client.os` is the only per-platform
  * attribution available to turn telemetry (`turn-events-store` forwards
  * `$.client` onto `TurnTelemetryEvent.client`). Without the stamp, desktop
  * and mobile usage are indistinguishable from browser usage downstream.
  *
- * Mirrors the mock harness of `dm-persistence.test.ts` — exercises
+ * Mirrors the mock harness of `dm-persistence.test.ts` and exercises
  * `persistQueuedMessageBody` directly with a captured `addMessage`.
  */
 import { beforeEach, describe, expect, mock, test } from "bun:test";
@@ -65,6 +65,7 @@ import type {
 import type { MessagingConversationContext } from "../daemon/conversation-messaging.js";
 import { persistQueuedMessageBody } from "../daemon/conversation-messaging.js";
 import type { MessageQueue } from "../daemon/conversation-queue-manager.js";
+import { isMacOriginatedUserMessage } from "../persistence/conversation-types.js";
 
 function createWebTurnContext(
   clientOs: string | undefined,
@@ -110,7 +111,7 @@ describe("client OS surface metadata persistence", () => {
     addMessageCalls.length = 0;
   });
 
-  test.each(["macos", "ios", "android", "web"])(
+  test.each(["macos", "windows", "ios", "android", "web"])(
     "stamps client.os = %s from the conversation's clientOs",
     async (os) => {
       const ctx = createWebTurnContext(os);
@@ -136,7 +137,7 @@ describe("client OS surface metadata persistence", () => {
   });
 
   test("omits the client bag for values outside the ClientOs vocabulary", async () => {
-    const ctx = createWebTurnContext("windows");
+    const ctx = createWebTurnContext("linux");
     await persistQueuedMessageBody(ctx, {
       content: "hello",
       requestId: "req-invalid",
@@ -173,3 +174,101 @@ describe("client OS surface metadata persistence", () => {
     });
   });
 });
+
+/**
+ * `Conversation.clientOs` is a live field that only a transport-carrying
+ * message refreshes, so a transport-less turn stamps whatever an earlier send
+ * left there. `clientOsFromRequest` separates the two, and
+ * {@link isMacOriginatedUserMessage} (the row-origin read behind the
+ * `chat.assistant_reply` presence gate) requires it before letting an attended
+ * Mac suppress a push.
+ */
+describe("client OS per-row evidence marker", () => {
+  beforeEach(() => {
+    addMessageCalls.length = 0;
+  });
+
+  test("marks an OS this row's own transport reported", async () => {
+    const ctx = createWebTurnContext("macos");
+    await persistQueuedMessageBody(ctx, {
+      content: "hello",
+      requestId: "req-transport-os",
+      requestClientOs: "macos",
+    });
+
+    expect(lastUserMetadata().client).toEqual({ os: "macos" });
+    expect(lastUserMetadata().clientOsFromRequest).toBe(true);
+    expect(isMacOriginatedUserMessage(lastUserMetadata())).toBe(true);
+  });
+
+  test("marks an OS this row's own request headers reported", async () => {
+    const ctx = createWebTurnContext(undefined);
+    await persistQueuedMessageBody(ctx, {
+      content: "hello",
+      requestId: "req-header-os",
+      metadata: { client: { os: "macos", interface_version: "0.8.2" } },
+    });
+
+    expect(lastUserMetadata().clientOsFromRequest).toBe(true);
+    expect(isMacOriginatedUserMessage(lastUserMetadata())).toBe(true);
+  });
+
+  // The bug shape: a button tapped on the phone reaches a conversation whose
+  // last desktop send left `clientOs: "macos"` behind. The row still carries
+  // the inherited OS for telemetry, but nothing says this turn came from the
+  // Mac, so the reply push must survive.
+  test("leaves an inherited OS unmarked and not Mac-originated", async () => {
+    const ctx = createWebTurnContext("macos");
+    await persistQueuedMessageBody(ctx, {
+      content: "[User action on card surface: submit]",
+      requestId: "req-inherited-os",
+    });
+
+    expect(lastUserMetadata().client).toEqual({ os: "macos" });
+    expect(lastUserMetadata().clientOsFromRequest).toBeUndefined();
+    expect(isMacOriginatedUserMessage(lastUserMetadata())).toBe(false);
+  });
+
+  // The marker vouches for the `client.os` that actually landed, not for
+  // whatever the row reported: a reported OS the stamp disagrees with is no
+  // evidence at all.
+  test("leaves the marker off when the reported OS is not the stamped one", async () => {
+    const ctx = createWebTurnContext("macos");
+    await persistQueuedMessageBody(ctx, {
+      content: "hello",
+      requestId: "req-mismatched-os",
+      requestClientOs: "ios",
+    });
+
+    expect(lastUserMetadata().client).toEqual({ os: "macos" });
+    expect(lastUserMetadata().clientOsFromRequest).toBeUndefined();
+    expect(isMacOriginatedUserMessage(lastUserMetadata())).toBe(false);
+  });
+
+  // The marker is derived from what this persist can see, so a bag value
+  // riding in from a caller must not survive the metadata spread and assert an
+  // origin the row never reported.
+  test("drops a caller-supplied marker from the metadata bag", async () => {
+    const ctx = createWebTurnContext("macos");
+    await persistQueuedMessageBody(ctx, {
+      content: "[User action on card surface: submit]",
+      requestId: "req-spoofed-marker",
+      metadata: { clientOsFromRequest: true },
+    });
+
+    expect(lastUserMetadata().clientOsFromRequest).toBeUndefined();
+    expect(isMacOriginatedUserMessage(lastUserMetadata())).toBe(false);
+  });
+
+  test("leaves the marker off for a reported OS outside the vocabulary", async () => {
+    const ctx = createWebTurnContext(undefined);
+    await persistQueuedMessageBody(ctx, {
+      content: "hello",
+      requestId: "req-unknown-os",
+      requestClientOs: "windows",
+    });
+
+    expect(lastUserMetadata().client).toBeUndefined();
+    expect(lastUserMetadata().clientOsFromRequest).toBeUndefined();
+  });
+});

package/src/__tests__/compactor-image-manifest-trust.test.ts

@@ -51,7 +51,7 @@ async function addImageMessage(
       skipIndexing: true,
     },
   );
-  attachInlineAttachmentToMessage(
+  await attachInlineAttachmentToMessage(
     inserted.id,
     0,
     filename,

package/src/__tests__/config-loader-backfill.test.ts

@@ -548,6 +548,25 @@ describe("loadConfig startup behavior", () => {
     expect(raw.daemon?.standaloneRecording).toBe(false);
   });
 
+  test("strips calls.voice.language from existing user configs", () => {
+    // `calls.voice.language` is a retired no-op knob: nothing read it.
+    // The spoken language lives at `services.stt.language` and per-language
+    // TTS voices at `services.tts.providers.<id>.languageVoices`. Existing
+    // configs that have it written to disk should load cleanly with the
+    // field stripped and its siblings preserved.
+    writeConfig({
+      provider: "anthropic",
+      calls: { voice: { language: "es-ES", telephonyStreaming: false } },
+    });
+
+    loadConfig();
+
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.calls?.voice?.language).toBeUndefined();
+    // Sibling fields under calls.voice are preserved
+    expect(raw.calls?.voice?.telephonyStreaming).toBe(false);
+  });
+
   test("still writes a default config on first launch when file is absent", () => {
     // Discoverability: when no config.json exists, write one populated with
     // all schema defaults so users can see and edit available options.