@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/__tests__/notification-platform-adapter.test.ts

@@ -340,6 +340,110 @@ describe("PlatformPushAdapter", () => {
     expect(result.remotePushAccepted).toBeUndefined();
   });
 
+  // A lock screen renders no markdown, so any marker that survives to the
+  // dispatch body reads as literal punctuation. See `stripMarkdownForPreview`.
+  describe("markdown flattening", () => {
+    test("flattens markdown out of the dispatched title and body", async () => {
+      const adapter = new PlatformPushAdapter();
+      const payload = makePayload({
+        copy: {
+          title: "**Build** finished",
+          body: [
+            "Here is the clip: ![vellum scene](vellum://workspace/a.mp4)",
+            "```ts",
+            "const a = 1;",
+            "```",
+            "| name | value |",
+            "| --- | --- |",
+            "| a | 1 |",
+          ].join("\n"),
+        },
+      });
+
+      const result = await adapter.send(payload, makeDestination());
+
+      expect(result.success).toBe(true);
+      const dispatched = fetchCalls[0]!.body;
+      expect(dispatched.title).toBe("Build finished");
+      const dispatchedBody = dispatched.body as string;
+      expect(dispatchedBody).not.toContain("![");
+      expect(dispatchedBody).not.toContain("```");
+      expect(dispatchedBody).not.toContain("|");
+      expect(dispatchedBody).toContain("Here is the clip:");
+      expect(dispatchedBody).toContain("const a = 1;");
+      expect(dispatchedBody).toContain("name value");
+    });
+
+    // Guardian question copy joins its question and instruction with a blank
+    // line, and iOS renders the break, so flattening must not collapse it.
+    test("preserves newlines in the dispatched body", async () => {
+      const adapter = new PlatformPushAdapter();
+      const payload = makePayload({
+        copy: {
+          title: "Question",
+          body: "Should I book the flight?\n\nReply here to answer.",
+        },
+      });
+
+      const result = await adapter.send(payload, makeDestination());
+
+      expect(result.success).toBe(true);
+      expect(fetchCalls[0]!.body.body).toBe(
+        "Should I book the flight?\n\nReply here to answer.",
+      );
+    });
+
+    test("leaves plain prose untouched", async () => {
+      const adapter = new PlatformPushAdapter();
+      const result = await adapter.send(makePayload(), makeDestination());
+
+      expect(result.success).toBe(true);
+      expect(fetchCalls[0]!.body.title).toBe("Reminder");
+      expect(fetchCalls[0]!.body.body).toBe("Check the oven!");
+    });
+
+    // The pass-through path copies a verbatim `requestedMessage` into both the
+    // title and the body, so media-only copy flattens both to nothing. Every
+    // empty-copy guard in the pipeline runs upstream of this adapter, and the
+    // platform's serializer rejects a blank title, so an unrecovered field
+    // costs the whole notification.
+    describe("copy that flattens to nothing", () => {
+      test("names the media instead of dispatching blank fields", async () => {
+        const adapter = new PlatformPushAdapter();
+        const embed = "![clip](vellum://workspace/a.mp4)";
+        const payload = makePayload({ copy: { title: embed, body: embed } });
+
+        const result = await adapter.send(payload, makeDestination());
+
+        expect(result.success).toBe(true);
+        expect(fetchCalls[0]!.body.title).toBe("Sent clip");
+        expect(fetchCalls[0]!.body.body).toBe("Sent clip");
+      });
+
+      test("counts several embeds", async () => {
+        const adapter = new PlatformPushAdapter();
+        const embeds =
+          "![one](vellum://workspace/1.mp4) ![two](https://e.com/2.png)";
+        const payload = makePayload({ copy: { title: embeds, body: embeds } });
+
+        await adapter.send(payload, makeDestination());
+
+        expect(fetchCalls[0]!.body.title).toBe("Sent 2 attachments");
+      });
+
+      // Nothing nameable is left, so the original beats a blank field: ugly
+      // copy still delivers, an empty title is a 400.
+      test("keeps the original when there is no media to name", async () => {
+        const adapter = new PlatformPushAdapter();
+        const payload = makePayload({ copy: { title: "###", body: "###" } });
+
+        await adapter.send(payload, makeDestination());
+
+        expect(fetchCalls[0]!.body.title).toBe("###");
+      });
+    });
+  });
+
   test("omits optional fields when absent from payload", async () => {
     const adapter = new PlatformPushAdapter();
     const payload: ChannelDeliveryPayload = {

package/src/__tests__/notification-schedule-notify-dedup.test.ts

@@ -3,7 +3,7 @@
  * deduplicated against prior firings of the same schedule.
  *
  * The scheduler supplies a unique per-firing dedupeKey
- * (`schedule:notify:<id>:<timestamp>`) so `updateEventDedupeKey` is never
+ * (`schedule:notify:<id>:<timestamp>`) so `setEventDedupeKey` is never
  * called for schedule signals and `checkDedupe` never finds a matching
  * row when the LLM decision engine generates a stable key like
  * `schedule:notify:<id>`.

package/src/__tests__/oauth-provider-profiles.test.ts

@@ -23,7 +23,7 @@ describe("oauth provider profiles (DB-seeded)", () => {
     );
   });
 
-  test("google provider row contains bearer injection templates for 4 Google API hosts", () => {
+  test("google provider row contains bearer injection templates for 6 Google API hosts", () => {
     const provider = getProvider("google");
 
     expect(provider).toBeDefined();
@@ -36,7 +36,7 @@ describe("oauth provider profiles (DB-seeded)", () => {
       valuePrefix: string;
     }>;
 
-    expect(templates).toHaveLength(4);
+    expect(templates).toHaveLength(6);
 
     const byHost = new Map(templates.map((t) => [t.hostPattern, t]));
 
@@ -45,6 +45,8 @@ describe("oauth provider profiles (DB-seeded)", () => {
       "www.googleapis.com",
       "people.googleapis.com",
       "docs.googleapis.com",
+      "tasks.googleapis.com",
+      "calendar.googleapis.com",
     ]) {
       const tpl = byHost.get(host);
       expect(tpl).toBeDefined();

package/src/__tests__/oauth-provider-seed-logos.test.ts

@@ -1,7 +1,44 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { describe, expect, test } from "bun:test";
 
 import { PROVIDER_SEED_DATA } from "../oauth/seed-providers.js";
 
+const REPO_ROOT = dirname(dirname(dirname(import.meta.dir)));
+const WEB_PUBLIC_DIR = join(REPO_ROOT, "clients/web/public");
+const INTEGRATION_ICON_SOURCE = join(
+  REPO_ROOT,
+  "clients/web/src/components/integrations/integration-icon.tsx",
+);
+
+/**
+ * Provider keys the web client draws without a `BUNDLED_LOGO_URLS` entry.
+ * Google's mark is multi-colour, so it ships as the `GoogleLogo` component
+ * and is returned before the bundled-asset lookup runs.
+ */
+const COMPONENT_RENDERED_PROVIDERS = new Set(["google"]);
+
+/** `publicAsset("/images/...")` paths from `BUNDLED_LOGO_URLS`, by key. */
+function readBundledLogoMap(): Map<string, string> {
+  const source = readFileSync(INTEGRATION_ICON_SOURCE, "utf8");
+  const block = source.match(
+    /const BUNDLED_LOGO_URLS: Record<string, string> = \{([\s\S]*?)\n\};/,
+  );
+  if (!block) {
+    throw new Error(
+      `Could not find BUNDLED_LOGO_URLS in ${INTEGRATION_ICON_SOURCE}. If it ` +
+        `was renamed or restructured, update this test rather than deleting it.`,
+    );
+  }
+  const entries = new Map<string, string>();
+  for (const [, key, path] of block[1]!.matchAll(
+    /(\w+):\s*publicAsset\("([^"]+)"\)/g,
+  )) {
+    entries.set(key!, path!);
+  }
+  return entries;
+}
+
 /**
  * Allowed CDN prefixes for the ``logoUrl`` field on ``PROVIDER_SEED_DATA``
  * (``assistant/src/oauth/seed-providers.ts``):
@@ -41,3 +78,31 @@ describe("PROVIDER_SEED_DATA logo URLs", () => {
     expect(invalid).toEqual([]);
   });
 });
+
+/**
+ * The `logoUrl` above is a fallback for providers registered at runtime. Every
+ * provider we seed ourselves must draw from an asset we ship, because an icon
+ * CDN can drop a brand at any time and the client then degrades to an initials
+ * avatar with nothing in CI to notice: the prefix check above passes just as
+ * happily for a URL that 404s. Simple Icons hosts no Microsoft mark and no
+ * Slack mark, so the seeded URLs for those brands do not resolve there.
+ */
+describe("PROVIDER_SEED_DATA bundled logo coverage", () => {
+  test("every seeded provider renders from a bundled asset", () => {
+    const bundled = readBundledLogoMap();
+    const uncovered = Object.keys(PROVIDER_SEED_DATA).filter(
+      (provider) =>
+        !bundled.has(provider) && !COMPONENT_RENDERED_PROVIDERS.has(provider),
+    );
+
+    expect(uncovered).toEqual([]);
+  });
+
+  test("every bundled logo path resolves to a file on disk", () => {
+    const missingFiles = [...readBundledLogoMap()]
+      .filter(([, path]) => !existsSync(join(WEB_PUBLIC_DIR, path)))
+      .map(([provider, path]) => ({ provider, path }));
+
+    expect(missingFiles).toEqual([]);
+  });
+});

package/src/__tests__/oauth-provider-serializer.test.ts

@@ -291,9 +291,26 @@ describe("serializeProviderSummary", () => {
       supports_managed_mode: true,
       managed_service_is_paid: false,
       feature_flag: null,
+      acts_as: "user",
     });
   });
 
+  test("names which sense of connected a provider represents", () => {
+    // The provider key does not say, and the naming actively misleads:
+    // `slack` is the user integration while its bot is `slack_channel`, but
+    // `telegram` is itself the bot. A caller asking "is X connected?" needs
+    // this to answer which X it found.
+    const sense = (provider: string) =>
+      serializeProviderSummary(makeRow({ provider }))!.acts_as;
+
+    expect(sense("slack")).toBe("user");
+    expect(sense("slack_channel")).toBe("assistant");
+    expect(sense("discord")).toBe("user");
+    expect(sense("discord_channel")).toBe("assistant");
+    expect(sense("telegram")).toBe("assistant");
+    expect(sense("google")).toBe("user");
+  });
+
   test("nullifies missing optional fields", () => {
     const row = makeRow({
       displayLabel: null,

package/src/__tests__/oauth-providers-routes.test.ts

@@ -178,6 +178,7 @@ describe("GET /v1/oauth/providers", () => {
       "supports_managed_mode",
       "managed_service_is_paid",
       "feature_flag",
+      "acts_as",
     ];
 
     for (const provider of providers) {

package/src/__tests__/openai-responses-prompt-cache.test.ts

@@ -238,16 +238,19 @@ describe("OpenAIResponsesProvider explicit prompt caching (GPT-5.6+)", () => {
     expect(breakpointedItemIndexes()).toEqual([0, 2]);
   });
 
-  test("volatile single-message first turn: no markers (nothing stable to anchor)", async () => {
+  test("volatile single-message first turn: the sole item is still marked", async () => {
     const provider = makeProvider("gpt-5.6-sol");
     await provider.sendMessage([userMsg("hi")], {
       config: { mutableLatestUserMessage: true, promptCacheKey: "conv-1" },
     });
 
+    // A volatile message is fixed within its own turn, so marking it prepays
+    // one write that the turn's tool-loop iterations read back, covering the
+    // instructions and tools that precede it in the cached prefix.
     expect(lastStreamParams?.prompt_cache_options).toEqual({
       mode: "explicit",
     });
-    expect(breakpointedItemIndexes()).toEqual([]);
+    expect(breakpointedItemIndexes()).toEqual([0]);
   });
 
   test("tool loop: single fixed anchor on the turn-start user item, none on function_call_output", async () => {

package/src/__tests__/path-policy.test.ts

@@ -15,6 +15,7 @@ import {
   resolveRealPath,
   sandboxPolicy,
   sandboxPolicyWithHostFallback,
+  sandboxReadPolicy,
 } from "../tools/shared/filesystem/path-policy.js";
 import { getDotEnvPath } from "../util/platform.js";
 
@@ -506,6 +507,162 @@ describe("sandboxPolicyWithHostFallback", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Sandbox read policy
+// ---------------------------------------------------------------------------
+
+describe("sandboxReadPolicy", () => {
+  afterEach(() => {
+    delete process.env.IS_CONTAINERIZED;
+    delete process.env.GATEWAY_SECURITY_DIR;
+    delete process.env.CREDENTIAL_SECURITY_DIR;
+  });
+
+  test("matches sandboxPolicy for in-bounds paths", () => {
+    const boundary = makeTempDir();
+    mkdirSync(join(boundary, "sub"));
+
+    const result = sandboxReadPolicy("sub/file.txt", boundary);
+    expect(result).toEqual(sandboxPolicy("sub/file.txt", boundary));
+    expect(result.ok).toBe(true);
+  });
+
+  test("reads outside the boundary when containerized", () => {
+    const boundary = makeTempDir();
+    const installTree = makeTempDir();
+    const target = join(installTree, "SKILL.md");
+    writeFileSync(target, "# skill");
+    process.env.IS_CONTAINERIZED = "true";
+
+    const result = sandboxReadPolicy(target, boundary);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.resolved).toBe(target);
+    }
+  });
+
+  test("follows an in-boundary symlink that points outside", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+    const target = join(outside, "reference.md");
+    writeFileSync(target, "reference body");
+    symlinkSync(target, join(boundary, "link.md"));
+    process.env.IS_CONTAINERIZED = "true";
+
+    const result = sandboxReadPolicy(join(boundary, "link.md"), boundary);
+    expect(result.ok).toBe(true);
+  });
+
+  test("denies the gateway security dir when containerized", () => {
+    const boundary = makeTempDir();
+    const securityDir = makeTempDir();
+    writeFileSync(join(securityDir, "trust.json"), "{}");
+    process.env.GATEWAY_SECURITY_DIR = securityDir;
+    process.env.IS_CONTAINERIZED = "true";
+
+    const result = sandboxReadPolicy(join(securityDir, "trust.json"), boundary);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("denies a symlink that resolves into the credential security dir", () => {
+    const boundary = makeTempDir();
+    const securityDir = makeTempDir();
+    writeFileSync(join(securityDir, "keys.enc"), "cipher");
+    symlinkSync(join(securityDir, "keys.enc"), join(boundary, "innocent.txt"));
+    process.env.CREDENTIAL_SECURITY_DIR = securityDir;
+    process.env.IS_CONTAINERIZED = "true";
+
+    const result = sandboxReadPolicy(join(boundary, "innocent.txt"), boundary);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("denies a denylisted basename outside the boundary", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+    writeFileSync(join(outside, "backup.key"), "key");
+    process.env.IS_CONTAINERIZED = "true";
+
+    const result = sandboxReadPolicy(join(outside, "backup.key"), boundary);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("fails closed to the hard boundary when a security-dir override is relative", () => {
+    const boundary = makeTempDir();
+    const outside = makeTempDir();
+    writeFileSync(join(outside, "file.txt"), "x");
+    // Unmirrorable deny set: the real security dir could be anywhere, so the
+    // read allowance must not widen past the boundary.
+    process.env.GATEWAY_SECURITY_DIR = "relative/security-dir";
+    process.env.IS_CONTAINERIZED = "true";
+
+    const result = sandboxReadPolicy(join(outside, "file.txt"), boundary);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("out_of_bounds");
+    }
+  });
+
+  // The daemon's own environment carries the actor token signing key, the CES
+  // service token, the guardian bootstrap secret, and forwarded provider API
+  // keys, so no policy may serve a process environment block.
+  test.each([
+    "/proc/self/environ",
+    "/proc/thread-self/environ",
+    "/proc/1/environ",
+    "/proc/4242/environ",
+  ])("denies %s", (path) => {
+    const boundary = makeTempDir();
+    process.env.IS_CONTAINERIZED = "true";
+
+    const result = sandboxReadPolicy(path, boundary, { mustExist: false });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("denies a process environ path reached through a symlink", () => {
+    const boundary = makeTempDir();
+    symlinkSync("/proc/self/environ", join(boundary, "innocent.txt"));
+    process.env.IS_CONTAINERIZED = "true";
+
+    const result = sandboxReadPolicy(join(boundary, "innocent.txt"), boundary, {
+      mustExist: false,
+    });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.reason).toBe("denied");
+    }
+  });
+
+  test("still allows other /proc entries", () => {
+    const boundary = makeTempDir();
+    process.env.IS_CONTAINERIZED = "true";
+
+    const result = sandboxReadPolicy("/proc/self/status", boundary, {
+      mustExist: false,
+    });
+    expect(result.ok).toBe(true);
+  });
+
+  test("does not deny an unrelated file named environ", () => {
+    const boundary = makeTempDir();
+    writeFileSync(join(boundary, "environ"), "notes");
+
+    const result = sandboxReadPolicy("environ", boundary);
+    expect(result.ok).toBe(true);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Host policy
 // ---------------------------------------------------------------------------
@@ -575,7 +732,13 @@ describe("resolveRealPath", () => {
   });
 
   test("falls back to the lexical path when nothing on it exists", () => {
-    const phantom = join(tmpdir(), "definitely-not-here-12345", "nope.txt");
+    // realpath the temp root so a symlinked prefix (macOS /var -> /private/var)
+    // is not mistaken for the resolution under test.
+    const phantom = join(
+      realpathSync(tmpdir()),
+      "definitely-not-here-12345",
+      "nope.txt",
+    );
     expect(resolveRealPath(phantom)).toBe(phantom);
   });
 });

package/src/__tests__/persist-media-references.test.ts

@@ -49,7 +49,7 @@ describe("referenceMediaBlocksForPersist", () => {
       },
     ];
 
-    const referenced = referenceMediaBlocksForPersist(
+    const referenced = await referenceMediaBlocksForPersist(
       conv.id,
       conv.createdAt,
       msg.id,
@@ -101,7 +101,7 @@ describe("referenceMediaBlocksForPersist", () => {
       },
     ];
 
-    const referenced = referenceMediaBlocksForPersist(
+    const referenced = await referenceMediaBlocksForPersist(
       conv.id,
       conv.createdAt,
       msg.id,

package/src/__tests__/persist-unsendable-image-downscale.test.ts

@@ -28,8 +28,8 @@ mock.module("../agent/image-optimize.js", () => ({
   // oversized (never undersized), so the min-dimension gate never matches
   // and the rejection-path upscale is never reached.
   isBelowMinDimension: () => false,
-  upscaleImageToMinimum: () => null,
-  optimizeImageForTransport: () => ({
+  upscaleImageToMinimum: async () => null,
+  optimizeImageForTransport: async () => ({
     data: SHRUNK_DATA,
     mediaType: "image/jpeg",
   }),
@@ -133,7 +133,7 @@ describe("persistUnsendableImageDowngrades (downscalable host)", () => {
     );
 
     // WHEN the downgrade is persisted
-    const rewritten = persistUnsendableImageDowngrades(conv.id);
+    const rewritten = await persistUnsendableImageDowngrades(conv.id);
 
     // THEN the nested block stays an image, rewritten to the downscaled payload
     expect(rewritten).toBe(1);
@@ -159,10 +159,10 @@ describe("persistUnsendableImageDowngrades (downscalable host)", () => {
       JSON.stringify([toolResultWithImage(oversizedPngBase64())]),
       { skipIndexing: true },
     );
-    expect(persistUnsendableImageDowngrades(conv.id)).toBe(1);
+    expect(await persistUnsendableImageDowngrades(conv.id)).toBe(1);
 
     // WHEN the downgrade runs again
-    const secondRun = persistUnsendableImageDowngrades(conv.id);
+    const secondRun = await persistUnsendableImageDowngrades(conv.id);
 
     // THEN nothing further is rewritten
     expect(secondRun).toBe(0);