@vellumai/assistant 0.11.2 → 0.11.3-staging.1

package/src/__tests__/persona-resolver.test.ts

@@ -63,6 +63,8 @@ function seedVellumGuardian(userFile: string | null): void {
 
 mock.module("../util/platform.js", () => ({
   getWorkspaceDir: () => mockWorkspaceDir,
+  getWorkspacePromptPath: (filename: string) =>
+    join(mockWorkspaceDir, "prompts", filename),
 }));
 
 mock.module("../contacts/contact-store.js", () => ({
@@ -96,6 +98,7 @@ mock.module("../contacts/guardian-delivery-reader.js", () => ({
 // Import AFTER mocks so the module under test binds to the stubbed
 // implementations.
 import { getGuardianDelivery } from "../contacts/guardian-delivery-reader.js";
+import { resolveUserName } from "../daemon/identity-helpers.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 import {
   ensureGuardianPersonaFile,
@@ -408,3 +411,154 @@ describe("resolveUserSlug (guardian trust WITH requester identity)", () => {
     expect(resolveUserSlug(trustContext)).toBeNull();
   });
 });
+
+// ── resolveUserSlug — guardian bound on a non-vellum channel ───────
+//
+// warmGuardianBindings warms both the channel-filtered and unfiltered cache
+// keys, but a guardian may be bound only on a non-vellum channel (phone,
+// Telegram). A guardian-class turn sourced elsewhere must still resolve that
+// guardian instead of silently landing on users/default.md.
+
+describe("resolveUserSlug (guardian bound on a non-vellum channel)", () => {
+  test("falls back to the any-channel guardian when the source channel has none", () => {
+    mockGuardianDeliveries = [
+      { channelType: "telegram", address: "guardian-tg", status: "active" },
+    ];
+    mockContactsByAddress["telegram:guardian-tg"] = { userFile: "alice.md" };
+
+    const trustContext = {
+      sourceChannel: "vellum",
+      trustClass: "guardian",
+    } as TrustContext;
+
+    expect(resolveUserSlug(trustContext)).toBe("alice");
+  });
+
+  test("any-channel guardian with no userFile resolves the guardian.md fallback", () => {
+    mockGuardianDeliveries = [
+      { channelType: "telegram", address: "guardian-tg", status: "active" },
+    ];
+    mockContactsByAddress["telegram:guardian-tg"] = { userFile: null };
+
+    const trustContext = {
+      sourceChannel: "vellum",
+      trustClass: "guardian",
+    } as TrustContext;
+
+    expect(resolveUserSlug(trustContext)).toBe("guardian");
+  });
+});
+
+// ── resolveUserSlug — cold cache then construction-time warm ───────
+//
+// The exact shape scheduled tasks and memory consolidation pass through
+// resolveInitialSystemPrompt: guardian class, no requester identity, built in
+// a worker process whose guardian-delivery cache starts cold.
+
+describe("resolveUserSlug (cold cache, background shape)", () => {
+  test("misses on a cold cache, resolves the guardian after the construction-time warm", async () => {
+    pendingWarmDeliveries = [
+      { channelType: "vellum", address: "vellum:self", status: "active" },
+    ];
+    mockContactsByAddress["vellum:vellum:self"] = { userFile: "alice.md" };
+
+    const trustContext = {
+      sourceChannel: "vellum",
+      trustClass: "guardian",
+    } as TrustContext;
+
+    // Cold: the sync peek finds nothing and the slug falls back to default.
+    expect(resolveUserSlug(trustContext)).toBeNull();
+
+    // resolveInitialSystemPrompt warms guardian bindings for guardian-class
+    // contexts before building; afterwards the same resolution succeeds.
+    await getGuardianDelivery({ channelTypes: ["vellum"] });
+
+    expect(resolveUserSlug(trustContext)).toBe("alice");
+  });
+});
+
+// ── resolveUserName — guardian-preferred display name ──────────────
+//
+// The sweep job and v2 router address the user by name in their prompts. The
+// name must come from the guardian's own persona file when one is resolvable,
+// falling back to users/default.md.
+
+describe("resolveUserName", () => {
+  test("prefers the Name label from the guardian's own persona file over default.md", () => {
+    seedVellumGuardian("alice.md");
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    writeFileSync(join(usersDir, "alice.md"), "**Name:** Alice\n", "utf-8");
+    writeFileSync(
+      join(usersDir, "default.md"),
+      "**Name:** Default User\n",
+      "utf-8",
+    );
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Alice");
+  });
+
+  test("reads the onboarding-written Preferred name bullet", () => {
+    seedVellumGuardian("alice.md");
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    writeFileSync(
+      join(usersDir, "alice.md"),
+      "# User Profile\n\n## Onboarding Context\n\n- **Preferred name:** Ali\n",
+      "utf-8",
+    );
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Ali");
+  });
+
+  test("reads the scaffold's filled Preferred name/reference line", () => {
+    seedVellumGuardian("alice.md");
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    writeFileSync(
+      join(usersDir, "alice.md"),
+      "- Preferred name/reference: Alice\n- Pronouns: she/her\n",
+      "utf-8",
+    );
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Alice");
+  });
+
+  test("an unfilled scaffold does not swallow the next line and falls back to default.md", () => {
+    seedVellumGuardian("alice.md");
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    // The bare scaffold: every label present, every value unfilled.
+    ensureGuardianPersonaFile("alice.md");
+    writeFileSync(join(usersDir, "default.md"), "**Name:** Bob\n", "utf-8");
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Bob");
+  });
+
+  test("a declined_by_user sentinel is not used as a name", () => {
+    seedVellumGuardian("alice.md");
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    writeFileSync(
+      join(usersDir, "alice.md"),
+      "- Preferred name/reference: declined_by_user\n",
+      "utf-8",
+    );
+    writeFileSync(join(usersDir, "default.md"), "**Name:** Bob\n", "utf-8");
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Bob");
+  });
+
+  test("falls back to default.md when no guardian resolves", () => {
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    writeFileSync(join(usersDir, "default.md"), "**Name:** Bob\n", "utf-8");
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Bob");
+  });
+
+  test("returns null when neither file yields a name", () => {
+    expect(resolveUserName(mockWorkspaceDir)).toBeNull();
+  });
+});

package/src/__tests__/plugin-api-webhook-url.test.ts

@@ -0,0 +1,170 @@
+/**
+ * `resolveWebhookUrl`: the URL a plugin hands a vendor.
+ *
+ * The resolution order itself belongs to `resolveCallbackUrl`, which is spied
+ * on here rather than reimplemented. Restating it would recreate the
+ * duplication this module exists to remove. What is covered is what this
+ * module adds: which plugin the route belongs to, the path it composes, the
+ * registration type it derives, and what it refuses.
+ */
+
+import { describe, expect, spyOn, test } from "bun:test";
+
+import * as registration from "../inbound/platform-callback-registration.js";
+import { resolveWebhookUrl } from "../plugin-api/webhook-url.js";
+import { runInPluginContext } from "../plugins/plugin-execution-context.js";
+
+describe("resolveWebhookUrl", () => {
+  test("composes the plugin's namespaced path and delegates the tier choice", async () => {
+    const spy = spyOn(registration, "resolveCallbackUrl").mockResolvedValue(
+      "https://callbacks.vellum.ai/abc/webhooks/plugins/imessage/events-photon",
+    );
+
+    const url = await resolveWebhookUrl({
+      plugin: "imessage",
+      path: "events-photon",
+    });
+
+    expect(url).toBe(
+      "https://callbacks.vellum.ai/abc/webhooks/plugins/imessage/events-photon",
+    );
+    expect(spy.mock.calls[0]![1]).toBe(
+      "webhooks/plugins/imessage/events-photon",
+    );
+    spy.mockRestore();
+  });
+
+  test("defaults to the plugin in context", async () => {
+    // Hooks and tools run in plugin context, so the common caller passes no
+    // plugin at all.
+    const spy = spyOn(registration, "resolveCallbackUrl").mockResolvedValue(
+      "https://example.test/x",
+    );
+
+    await runInPluginContext("imessage", () =>
+      resolveWebhookUrl({ path: "events-comms" }),
+    );
+
+    expect(spy.mock.calls[0]![1]).toBe(
+      "webhooks/plugins/imessage/events-comms",
+    );
+    spy.mockRestore();
+  });
+
+  test("an explicit plugin wins over the one in context", async () => {
+    const spy = spyOn(registration, "resolveCallbackUrl").mockResolvedValue(
+      "https://example.test/x",
+    );
+
+    await runInPluginContext("other", () =>
+      resolveWebhookUrl({ plugin: "imessage", path: "events-comms" }),
+    );
+
+    expect(spy.mock.calls[0]![1]).toBe(
+      "webhooks/plugins/imessage/events-comms",
+    );
+    spy.mockRestore();
+  });
+
+  test("says so when there is no plugin to attribute the route to", async () => {
+    await expect(resolveWebhookUrl({ path: "events" })).rejects.toThrow(
+      /No plugin is in context/,
+    );
+  });
+
+  test("gives routes that share a slug distinct registration types", async () => {
+    // The platform keys a callback route by type, so a collision has the
+    // second registration replace the first. `events-v1` and `events_v1`
+    // slugify identically.
+    const spy = spyOn(registration, "resolveCallbackUrl").mockResolvedValue(
+      "https://example.test/x",
+    );
+
+    await resolveWebhookUrl({ plugin: "imessage", path: "events-v1" });
+    await resolveWebhookUrl({ plugin: "imessage", path: "events_v1" });
+
+    const types = spy.mock.calls.map((call) => call[2]);
+    expect(new Set(types).size).toBe(2);
+    spy.mockRestore();
+  });
+
+  test("accepts the paths the gateway's route schema accepts", async () => {
+    // A path this rejects but the gateway serves is a route a plugin can
+    // install and then never resolve a URL for.
+    const spy = spyOn(registration, "resolveCallbackUrl").mockResolvedValue(
+      "https://example.test/x",
+    );
+
+    for (const path of [
+      "events-photon",
+      "events:v1",
+      "hooks/@vendor",
+      "a/b/c",
+    ]) {
+      await expect(
+        resolveWebhookUrl({ plugin: "imessage", path }),
+      ).resolves.toBeDefined();
+    }
+    spy.mockRestore();
+  });
+
+  test("refuses a plugin name or path that escapes the namespace", async () => {
+    // The prefix is fixed so a plugin cannot claim another's routes. That only
+    // holds if the segments cannot escape it either.
+    for (const options of [
+      { plugin: "../vellum", path: "events" },
+      { plugin: "imessage", path: "../../admin" },
+      { plugin: "imessage", path: "/events" },
+      { plugin: "imessage", path: "events/" },
+      { plugin: "imessage", path: "events?x=1" },
+      { plugin: "imessage", path: "%2e%2e/admin" },
+      { plugin: "imessage", path: "" },
+    ]) {
+      await expect(resolveWebhookUrl(options)).rejects.toThrow(/Invalid/);
+    }
+  });
+
+  test("hands the vendor a URL with no trailing slash", async () => {
+    // The platform appends one, and a provider delivers to the URL it was
+    // given verbatim. The gateway matches the declared path, which never ends
+    // in a slash, so a registration carrying one 404s every delivery.
+    const spy = spyOn(registration, "resolveCallbackUrl").mockResolvedValue(
+      "https://callbacks.vellum.ai/abc/webhooks/plugins/imessage/events-comms/",
+    );
+
+    await expect(
+      resolveWebhookUrl({ plugin: "imessage", path: "events-comms" }),
+    ).resolves.toBe(
+      "https://callbacks.vellum.ai/abc/webhooks/plugins/imessage/events-comms",
+    );
+    spy.mockRestore();
+  });
+
+  test("leaves a URL carrying a query string alone", async () => {
+    // Trimming there would cut into the query rather than the path.
+    const spy = spyOn(registration, "resolveCallbackUrl").mockResolvedValue(
+      "https://example.test/webhooks/plugins/imessage/events-comms?token=abc/",
+    );
+
+    await expect(
+      resolveWebhookUrl({ plugin: "imessage", path: "events-comms" }),
+    ).resolves.toBe(
+      "https://example.test/webhooks/plugins/imessage/events-comms?token=abc/",
+    );
+    spy.mockRestore();
+  });
+
+  test("propagates the failure when nothing can answer", async () => {
+    // No ingress and no platform connection means there is no URL that works.
+    // Returning a plausible one would produce a vendor registration that
+    // silently receives nothing.
+    const spy = spyOn(registration, "resolveCallbackUrl").mockRejectedValue(
+      new Error("Public ingress URL is not configured"),
+    );
+
+    await expect(
+      resolveWebhookUrl({ plugin: "imessage", path: "events-photon" }),
+    ).rejects.toThrow("Public ingress URL is not configured");
+    spy.mockRestore();
+  });
+});

package/src/__tests__/plugin-import-boundary-guard.test.ts

@@ -115,6 +115,12 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../../config/skill-state.js",
     "../../../../config/skills.js",
     "../../../../config/types.js",
+    // Same host module the retrospective job couples to (the `../../../`
+    // entry below): the sweep job and v2 router warm the guardian-delivery
+    // cache before their sync `resolveUserName` reads so worker-process
+    // prompts address the guardian instead of the default profile. No
+    // plugin-api equivalent.
+    "../../../../contacts/guardian-delivery-reader.js",
     "../../../../context/token-estimator.js",
     "../../../../daemon/conversation-error.js",
     "../../../../daemon/conversation-notices.js",

package/src/__tests__/processing-flag-persist-failure.test.ts

@@ -1,9 +1,15 @@
 /**
  * Regression: `Conversation.setProcessing(value)` flips the in-memory flag and
- * then persists it to the `processing_started_at` column. If that DB write
- * throws (e.g. SQLITE_BUSY under contention), the in-memory flag must not be
- * left stranded out of sync with the column — it reverts to its prior value
- * and the error re-throws so callers' existing failure handling still runs.
+ * then persists it to the `processing_started_at` column. The two directions
+ * treat a failed write differently, and both are covered here.
+ *
+ * Acquiring is strict: the in-memory flag reverts to its prior value and the
+ * error re-throws so callers' existing failure handling still runs.
+ *
+ * Clearing is not: the in-memory flag is this process's queue gate while the
+ * column is advisory state the boot-time stale-processing sweep recovers, so a
+ * failed mirror write must still leave the conversation released rather than
+ * latching it "busy" for the rest of the daemon's life.
  */
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
@@ -209,17 +215,16 @@ describe("Conversation.setProcessing persistence failure", () => {
     expect(conversation.isProcessing()).toBe(false);
   });
 
-  test("restores the prior value when clearing fails mid-turn", () => {
+  test("releases in memory when the clear's mirror write fails", () => {
     conversation.setProcessing(true);
     expect(conversation.isProcessing()).toBe(true);
 
     persistShouldThrow = true;
-    expect(() => conversation.setProcessing(false)).toThrow(
-      "database is locked",
-    );
+    expect(() => conversation.setProcessing(false)).not.toThrow();
 
-    // Clear didn't persist, so the flag stays consistent with the column.
-    expect(conversation.isProcessing()).toBe(true);
+    // The queue gate is the in-memory flag, so a failed advisory write must
+    // not leave the conversation rejecting every later send as "busy".
+    expect(conversation.isProcessing()).toBe(false);
   });
 
   test("commits the flag when the DB write succeeds", () => {

package/src/__tests__/profile-availability-incomplete.test.ts

@@ -0,0 +1,113 @@
+/**
+ * `computeProfileAvailability` on profiles that carry no dispatchable pair.
+ *
+ * A rung only wins if its profile carries both a provider and a model
+ * (`usableEntry` in config/llm-resolver.ts). A profile missing either is
+ * skipped and the call site resolves elsewhere, so the profiles read has to
+ * report that state rather than returning "nothing to judge", which clients
+ * render as healthy.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import {
+  computeProfileAvailability,
+  isUnavailable,
+} from "../providers/inference/connection-availability.js";
+import { describeUnavailableProfile } from "../runtime/routes/inference-profile-availability-guard.js";
+
+describe("incomplete profiles", () => {
+  test("no provider and no model reports both as missing", async () => {
+    const availability = await computeProfileAvailability({});
+    expect(availability?.status).toBe("incomplete");
+    expect(availability?.message).toContain("a provider and a model");
+  });
+
+  test("a model with no provider names the provider", async () => {
+    const availability = await computeProfileAvailability({
+      model: "claude-opus-5",
+    });
+    expect(availability?.status).toBe("incomplete");
+    expect(availability?.message).toContain("a provider");
+    expect(availability?.message).not.toContain("a provider and a model");
+  });
+
+  test("a provider with no model names the model", async () => {
+    const availability = await computeProfileAvailability({
+      provider: "anthropic",
+    });
+    expect(availability?.status).toBe("incomplete");
+    expect(availability?.message).toContain("a model");
+  });
+
+  // The destination is deliberately unnamed: which profile a call site falls
+  // back to depends on the call site, so the message states the effect only.
+  test("the message names the effect without naming a destination", async () => {
+    const availability = await computeProfileAvailability({});
+    expect(availability?.message).toContain("fall back to another profile");
+  });
+});
+
+describe("mix profiles", () => {
+  // A mix carries no provider or model of its own: the resolver expands it to
+  // a seeded arm and judges that arm. Reporting a mix as incomplete would put
+  // a warning on every working mix profile.
+  test("a mix still reports nothing to judge", async () => {
+    const availability = await computeProfileAvailability({
+      mix: [
+        { profile: "balanced", weight: 1 },
+        { profile: "quality", weight: 1 },
+      ],
+    });
+    expect(availability).toBeNull();
+  });
+
+  test("a mix that also names a provider and model is judged normally", async () => {
+    const availability = await computeProfileAvailability({
+      mix: [{ profile: "balanced", weight: 1 }],
+      provider: "anthropic",
+      model: "claude-opus-5",
+    });
+    expect(availability?.status).not.toBe("incomplete");
+  });
+});
+
+describe("selection guards", () => {
+  // The resolver skips an incomplete profile on every turn, so pinning one
+  // means the user's selection is not what runs. Before `incomplete` existed,
+  // a provider without a model reached the auto-resolve branch and could
+  // return `missing_connection`, which these guards already rejected; the new
+  // verdict has to keep that door shut rather than open it.
+  test("an incomplete profile counts as unavailable", async () => {
+    expect(isUnavailable(await computeProfileAvailability({}))).toBe(true);
+    expect(
+      isUnavailable(
+        await computeProfileAvailability({ provider: "anthropic" }),
+      ),
+    ).toBe(true);
+  });
+
+  test("a mix is still not judged, so it is not blocked", async () => {
+    expect(
+      isUnavailable(
+        await computeProfileAvailability({
+          mix: [{ profile: "balanced", weight: 1 }],
+        }),
+      ),
+    ).toBe(false);
+  });
+
+  // `describeUnavailableProfile` interpolates the provider, which an
+  // incomplete profile may not have. Its guidance must not leak "undefined".
+  test("the repair guidance names the fix without inventing a provider", async () => {
+    const availability = await computeProfileAvailability({});
+    const message = await describeUnavailableProfile({
+      availability: availability!,
+      provider: String(undefined),
+      repair: { kind: "repoint", profileName: "half-made" },
+      escapeHatch: false,
+    });
+    expect(message).not.toContain("undefined");
+    expect(message).toContain("provider and a model");
+  });
+});

package/src/__tests__/profiler-routes.test.ts

@@ -185,11 +185,11 @@ describe("Profiler routes", () => {
         );
       });
 
-      test(`POST export rejects runId "${payload}"`, () => {
+      test(`POST export rejects runId "${payload}"`, async () => {
         const route = findRoute("profiler_runs_by_runId_export_post")!;
-        expect(() => route.handler({ pathParams: { runId: payload } })).toThrow(
-          BadRequestError,
-        );
+        await expect(
+          route.handler({ pathParams: { runId: payload } }),
+        ).rejects.toThrow(BadRequestError);
       });
 
       test(`DELETE rejects runId "${payload}"`, () => {
@@ -270,29 +270,29 @@ describe("Profiler routes", () => {
   });
 
   describe("POST /v1/profiler/runs/:runId/export", () => {
-    test("returns 404 for missing run", () => {
+    test("returns 404 for missing run", async () => {
       const route = findRoute("profiler_runs_by_runId_export_post")!;
-      expect(() =>
+      await expect(
         route.handler({ pathParams: { runId: "nonexistent" } }),
-      ).toThrow(NotFoundError);
+      ).rejects.toThrow(NotFoundError);
     });
 
-    test("returns tar.gz bytes for a valid run", () => {
+    test("returns tar.gz bytes for a valid run", async () => {
       createRun("exportable-run", {
         sizeBytes: 512,
         manifest: { status: "completed" },
       });
 
       const route = findRoute("profiler_runs_by_runId_export_post")!;
-      const result = route.handler({
+      const result = (await route.handler({
         pathParams: { runId: "exportable-run" },
-      }) as Uint8Array;
+      })) as Uint8Array;
 
       expect(result).toBeInstanceOf(Uint8Array);
       expect(result.byteLength).toBeGreaterThan(0);
     });
 
-    test("returns 500 when archive exceeds size limit", () => {
+    test("returns 500 when archive exceeds size limit", async () => {
       // Create a run with a very large file that will exceed the 50MB archive cap.
       const runDir = join(runsDir, "huge-run");
       mkdirSync(runDir, { recursive: true });
@@ -325,9 +325,9 @@ describe("Profiler routes", () => {
       }
 
       const route = findRoute("profiler_runs_by_runId_export_post")!;
-      expect(() =>
+      await expect(
         route.handler({ pathParams: { runId: "huge-run" } }),
-      ).toThrow(InternalError);
+      ).rejects.toThrow(InternalError);
     }, 30000);
   });