@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/__tests__/messages-read-boundary-guard.test.ts

@@ -0,0 +1,134 @@
+import { readFileSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import { Glob } from "bun";
+
+/**
+ * Ratchet over direct reads of the `messages` table outside `persistence/`.
+ *
+ * Every row in `messages` is conversation content in some state of
+ * completeness, and each read encodes a visibility decision (completed
+ * history vs. any row). `persistence/` owns that contract: named accessors in
+ * `message-reads.ts` and the history readers in `conversation-crud.ts` state
+ * their decision in their name; everything else should go through them. A
+ * direct reader that re-decides visibility on its own is how the contract
+ * fails silently, so a new direct read is a reviewed exception, not a
+ * default.
+ *
+ * The BASELINE lists every file outside `persistence/` that reads the table
+ * directly today. Each entry has been audited and carries its visibility
+ * decision as a comment at the read site. The guard fails when a file outside
+ * the baseline gains a direct read (route it through an accessor, or audit it
+ * and baseline it with a site comment explaining the decision in your PR),
+ * and when a baseline entry goes stale (remove it, so coverage cannot rot).
+ *
+ * Detection is deliberately shape-based (from/join of `messages` in drizzle
+ * builders, `FROM messages` / `JOIN messages` in raw SQL): this is a ratchet
+ * against sprawl, not a proof, and matching the read shapes keeps it free of
+ * false positives from unrelated identifiers.
+ *
+ * Regenerate after an intentional change with:
+ *   UPDATE_MESSAGES_READ_BASELINE=1 bun test src/__tests__/messages-read-boundary-guard.test.ts
+ * and paste the printed list here, explaining the new read in your PR.
+ */
+
+const SRC_REL = "src";
+const SRC_ABS = join(process.cwd(), SRC_REL);
+
+/**
+ * Audited direct readers outside persistence/, as file -> count of matching
+ * read sites. Counts, not just filenames: a new read added inside an
+ * already-baselined file must fail the ratchet too, since each site carries
+ * its own visibility decision. A same-file refactor that replaces one read
+ * with another at equal count passes; that is accepted ratchet granularity
+ * (the diff still shows the site to its reviewer).
+ */
+const BASELINE: Readonly<Record<string, number>> = {
+  "src/apps/app-store.ts": 1,
+  "src/daemon/credential-transcript-scrub.ts": 1,
+  "src/live-voice/live-voice-archive.ts": 1,
+  "src/monitoring/recovery/inflight-content.ts": 2,
+  "src/plugins/defaults/memory/context-search/sources/conversations.ts": 1,
+  "src/plugins/defaults/memory/graph/image-ref-utils.ts": 1,
+  "src/plugins/defaults/memory/indexer.ts": 2,
+  "src/plugins/defaults/memory/memory-retrospective-accounting.ts": 4,
+  "src/plugins/defaults/memory/substrate/sweep-job.ts": 1,
+  "src/plugins/defaults/memory/v1/graph/extraction.ts": 3,
+  "src/plugins/defaults/memory/v1/job-handlers/backfill.ts": 1,
+  "src/plugins/defaults/memory/v1/job-handlers/embedding.ts": 1,
+  "src/plugins/defaults/memory/v1/job-handlers/index-maintenance.ts": 1,
+  "src/plugins/defaults/memory/v2/harness/oracle.ts": 1,
+  "src/plugins/defaults/memory/v2/harness/replay-input.ts": 1,
+  "src/plugins/defaults/memory/v3-eval/eval-packets.ts": 2,
+  "src/plugins/defaults/memory/v3/prune.ts": 1,
+  "src/plugins/defaults/memory/v3/selection-log-store.ts": 1,
+  "src/runtime/pre-first-message-gate.ts": 1,
+  "src/runtime/routes/log-export-routes.ts": 1,
+  "src/runtime/routes/surface-conversation-resolver.ts": 2,
+  "src/telemetry/turn-events-store.ts": 2,
+  "src/telemetry/turn-trace-store.ts": 2,
+  "src/workspace/migrations/rebuild-conversation-disk-view.ts": 1,
+};
+
+const DRIZZLE_READ =
+  /\.(?:from|innerJoin|leftJoin|rightJoin|fullJoin)\(\s*messages\s*[,)]/g;
+const RAW_SQL_READ = /(?:FROM|JOIN)\s+messages\b/g;
+
+function isExempt(relPath: string): boolean {
+  const parts = relPath.split(sep);
+  return (
+    parts[1] === "persistence" ||
+    parts.includes("__tests__") ||
+    relPath.endsWith(".test.ts")
+  );
+}
+
+async function scanDirectReaders(): Promise<Map<string, number>> {
+  const glob = new Glob("**/*.ts");
+  const found = new Map<string, number>();
+  for await (const file of glob.scan({ cwd: SRC_ABS, absolute: true })) {
+    const relPath = join(SRC_REL, relative(SRC_ABS, file));
+    if (isExempt(relPath)) {
+      continue;
+    }
+    const source = readFileSync(file, "utf-8");
+    const count =
+      [...source.matchAll(DRIZZLE_READ)].length +
+      [...source.matchAll(RAW_SQL_READ)].length;
+    if (count > 0) {
+      found.set(relPath, count);
+    }
+  }
+  return found;
+}
+
+describe("messages read boundary", () => {
+  test("no new direct messages reads beyond the audited baseline", async () => {
+    const found = await scanDirectReaders();
+
+    if (process.env.UPDATE_MESSAGES_READ_BASELINE === "1") {
+      console.log(
+        JSON.stringify(Object.fromEntries([...found].sort()), null, 2),
+      );
+    }
+
+    const grown = [...found]
+      .filter(([file, count]) => count > (BASELINE[file] ?? 0))
+      .map(([file, count]) => `${file}: ${BASELINE[file] ?? 0} -> ${count}`);
+    expect(
+      grown,
+      `New direct reads of the messages table outside persistence/ (route ` +
+        `through an accessor in persistence/message-reads.ts, or audit the ` +
+        `read, state its visibility decision at the site, and baseline it):`,
+    ).toEqual([]);
+
+    const shrunk = Object.entries(BASELINE)
+      .filter(([file, count]) => (found.get(file) ?? 0) < count)
+      .map(([file, count]) => `${file}: ${count} -> ${found.get(file) ?? 0}`);
+    expect(
+      shrunk,
+      "Stale baseline entries (fewer direct reads than baselined; ratchet the count down so coverage cannot rot):",
+    ).toEqual([]);
+  });
+});

package/src/__tests__/mtime-cache.test.ts

@@ -30,14 +30,15 @@ import {
 } from "bun:test";
 
 import { _inspectHookCacheForTests } from "../hooks/hook-loader.js";
+import { getUserHooksFor } from "../hooks/registry.js";
 import {
   _inspectToolCacheForTests,
   getCachedUserTools,
-  getUserHooksFor,
   populateCacheAtBoot,
   reconcilePluginSourcesNow,
   resetPluginCacheForTests,
 } from "../plugins/mtime-cache.js";
+import { resetPluginRegistryForTests } from "../plugins/registry.js";
 import { getSourceVersionsPath } from "../plugins/source-versions.js";
 import {
   __resetRegistryForTesting,
@@ -157,6 +158,7 @@ beforeEach(() => {
   // The registry pulls plugin tools via loadPluginTools(); clear its side
   // (tools + pulled fingerprints) so registrations never leak across tests.
   __resetRegistryForTesting();
+  resetPluginRegistryForTests();
 });
 
 afterAll(() => {

package/src/__tests__/non-member-access-request.test.ts

@@ -501,7 +501,6 @@ describe("access-request-helper unit tests", () => {
 
   test("notifyGuardianOfAccessRequest returns no_sender_id when actorExternalId is absent", async () => {
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: undefined,
@@ -522,7 +521,6 @@ describe("access-request-helper unit tests", () => {
 
   test("notifyGuardianOfAccessRequest creates request with self-healed principal when no binding exists", async () => {
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -565,7 +563,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "tg-chat",
       actorExternalId: "unknown-tg-user",
@@ -619,7 +616,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -660,7 +656,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -688,7 +683,6 @@ describe("access-request-helper unit tests", () => {
   test("notifyGuardianOfAccessRequest resolves the vellum anchor from the gateway delivery", async () => {
     // Only the vellum anchor (seeded in resetState) is served by the gateway.
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -722,7 +716,6 @@ describe("access-request-helper unit tests", () => {
 
     await expect(
       notifyGuardianOfAccessRequest({
-        canonicalAssistantId: "self",
         sourceChannel: "telegram",
         conversationExternalId: "chat-123",
         actorExternalId: "unknown-user",
@@ -739,7 +732,6 @@ describe("access-request-helper unit tests", () => {
 
   test("notifyGuardianOfAccessRequest for voice channel includes actorDisplayName in contextPayload", async () => {
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "phone",
       conversationExternalId: "+15559998888",
       actorExternalId: "+15559998888",
@@ -770,7 +762,6 @@ describe("access-request-helper unit tests", () => {
 
   test("notifyGuardianOfAccessRequest includes requestCode in contextPayload", async () => {
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -794,7 +785,6 @@ describe("access-request-helper unit tests", () => {
     // is created and the status is forwarded to the card payload. (A `revoked`
     // status would instead suppress — covered by the keep-out tests.)
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "pending-user",
@@ -834,7 +824,6 @@ describe("access-request-helper unit tests", () => {
     };
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "phone",
       conversationExternalId: "+15556667777",
       actorExternalId: "+15556667777",
@@ -897,7 +886,6 @@ describe("access-request-helper unit tests", () => {
     };
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -929,7 +917,6 @@ describe("access-request-helper unit tests", () => {
     // request row. A revoked/blocked contact is deliberately kept out — no new
     // prompt, signal, or pending request.
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-kept-out",
       actorExternalId: "revoked-user",
@@ -969,7 +956,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-parked",
       actorExternalId: "parked-user",
@@ -1006,7 +992,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-approved",
       actorExternalId: "approved-user",
@@ -1047,7 +1032,6 @@ describe("access-request-helper unit tests", () => {
     bridgeState.requests.get(requestId)!.updatedAt = staleUpdatedAt;
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-stale",
       actorExternalId: "stale-user",
@@ -1082,7 +1066,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-flip",
       actorExternalId: "flip-user",
@@ -1101,7 +1084,6 @@ describe("access-request-helper unit tests", () => {
     // Suppression is scoped to the sender via their own contact status, so a
     // kept-out contact never bleeds into a different sender's prompt.
     const keptOut = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-kept",
       actorExternalId: "revoked-user",
@@ -1112,7 +1094,6 @@ describe("access-request-helper unit tests", () => {
 
     // A different sender with no keep-out still gets a fresh prompt.
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-fresh",
       actorExternalId: "fresh-user",
@@ -1141,7 +1122,6 @@ describe("maybeNotifyGuardianOfAdmittedContact", () => {
   });
 
   const baseParams = {
-    canonicalAssistantId: "self",
     sourceChannel: "telegram" as const,
     conversationExternalId: "chat-123",
     actorExternalId: "user-unknown-456",

package/src/__tests__/outbound-slack-persistence.test.ts

@@ -103,7 +103,10 @@ mock.module("../persistence/conversation-crud.js", () => ({
   },
   // The handler treats provenance as a flat spread; returning {} keeps the
   // metadata snapshot focused on the fields under test.
-  provenanceFromTrustContext: () => ({}),
+  // Mirrors the real mapping so provenance assertions observe what production
+  // stamps rather than a placeholder.
+  provenanceFromTrustContext: (ctx?: { trustClass?: string }) =>
+    ctx ? { provenanceTrustClass: ctx.trustClass } : {},
   reserveMessage: mock(
     async (
       conversationId: string,
@@ -187,6 +190,8 @@ function makeDeps(
     requesterTimezoneLabel?: string;
     clientTimezone?: string;
     sourceThreadId?: string;
+    /** Turn-local trust; when set, the live slot below diverges from it. */
+    currentTurnTrustContext?: Record<string, unknown>;
   } = {},
 ): EventHandlerDeps {
   const assistantMessageChannel = overrides.assistantMessageChannel ?? "slack";
@@ -195,6 +200,7 @@ function makeDeps(
       conversationId,
       provider: { name: "anthropic" },
       currentTurnSurfaces: [],
+      currentTurnTrustContext: overrides.currentTurnTrustContext,
       trustContext: {
         sourceChannel: assistantMessageChannel,
         trustClass: "guardian",
@@ -439,6 +445,39 @@ describe("outbound assistant Slack metadata persistence", () => {
     expect(slackMeta.channelTs).toBeUndefined();
   });
 
+  test("envelope resolves from the turn's actor when the slot has moved", async () => {
+    // Provenance class and Slack routing must come from ONE actor: the turn's.
+    // A queued Slack turn runs while the guardian has since written the live
+    // slot; the assistant row must carry the sender's class AND the sender's
+    // channel/thread, not a mixed envelope.
+    const conversationId = "conv-slack-moved-slot";
+    const deps = makeDeps(conversationId, {
+      assistantMessageChannel: "slack",
+      // Live slot: the guardian, on a different chat, no thread.
+      requesterChatId: "C-GUARDIAN",
+      currentTurnTrustContext: {
+        sourceChannel: "slack",
+        trustClass: "trusted_contact",
+        requesterChatId: "C-CONTACT",
+        sourceThreadId: "1723300000.000100",
+      },
+    });
+    await handleLlmCallStarted(state, deps);
+    await handleMessageComplete(
+      state,
+      deps,
+      makeMessageCompleteEvent("reply to the contact"),
+    );
+
+    const persisted = lastAssistantPersisted();
+    expect(persisted.metadata?.provenanceTrustClass).toBe("trusted_contact");
+    const slackMeta = JSON.parse(
+      persisted.metadata?.slackMeta as string,
+    ) as Record<string, unknown>;
+    expect(slackMeta.channelId).toBe("C-CONTACT");
+    expect(slackMeta.threadTs).toBe("1723300000.000100");
+  });
+
   test("ignores a non-ts sourceThreadId", async () => {
     const conversationId = "conv-slack-bad-thread";
     const channelId = "C789BAD";

package/src/__tests__/platform-bash-auto-approve.test.ts

@@ -44,12 +44,8 @@ mock.module("../permissions/checker.js", () => ({
     }
     return { decision: "allow", reason: "allowed" };
   },
-  generateAllowlistOptions: () => [
-    { label: "exact", description: "exact", pattern: "exact" },
-  ],
   generateScopeOptions: () =>
     scopeOptionsOverride ?? [{ label: "/tmp", scope: "/tmp" }],
-  getCachedAssessment: () => undefined,
 }));
 
 // Mock every export so downstream test files that dynamically import modules

package/src/__tests__/plugin-api-store-credential.test.ts

@@ -0,0 +1,261 @@
+import { randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  afterAll,
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  spyOn,
+  test,
+} from "bun:test";
+
+import { credentialKey } from "@vellumai/credential-storage";
+
+import * as scrub from "../daemon/credential-transcript-scrub.js";
+import * as manualToken from "../oauth/manual-token-connection.js";
+import { resolveCredential } from "../plugin-api/resolve-credential.js";
+import {
+  CredentialStoreError,
+  storeCredential,
+} from "../plugin-api/store-credential.js";
+import { runInPluginContext } from "../plugins/plugin-execution-context.js";
+import * as secureKeys from "../security/secure-keys.js";
+import {
+  _setMetadataPath,
+  getCredentialMetadata,
+} from "../tools/credentials/metadata-store.js";
+import { storeCredentialValue } from "../tools/credentials/store.js";
+
+// Real metadata store backed by a temp file. A mock.module on metadata-store
+// or secure-keys would replace the whole module namespace, so only the secure
+// backend access, the transcript scrub, and the manual-token connection sync
+// are intercepted, via restorable spies.
+
+const TEST_DIR = join(
+  tmpdir(),
+  `vellum-plugin-storecred-${randomBytes(4).toString("hex")}`,
+);
+const META_PATH = join(TEST_DIR, "metadata.json");
+
+/** The plugin every scoped case runs as: it owns the `acme` field. */
+const PLUGIN = "acme";
+
+/** Run `fn` as the plugin would: inside its execution context. */
+function asPlugin<T>(fn: () => T): T {
+  return runInPluginContext(PLUGIN, fn);
+}
+
+let secureStore: Map<string, string>;
+let writeSucceeds: boolean;
+let setSpy: ReturnType<typeof spyOn>;
+let getSpy: ReturnType<typeof spyOn>;
+let scrubSpy: ReturnType<typeof spyOn>;
+let syncSpy: ReturnType<typeof spyOn>;
+
+beforeEach(() => {
+  if (existsSync(TEST_DIR)) {
+    rmSync(TEST_DIR, { recursive: true });
+  }
+  mkdirSync(TEST_DIR, { recursive: true });
+  _setMetadataPath(META_PATH);
+
+  secureStore = new Map();
+  writeSucceeds = true;
+  setSpy = spyOn(secureKeys, "setSecureKeyAsync").mockImplementation(
+    async (key: string, value: string) => {
+      if (!writeSucceeds) {
+        return false;
+      }
+      secureStore.set(key, value);
+      return true;
+    },
+  );
+  getSpy = spyOn(secureKeys, "getSecureKeyResultAsync").mockImplementation(
+    async (key: string) => ({
+      value: secureStore.get(key),
+      unreachable: false,
+    }),
+  );
+  scrubSpy = spyOn(
+    scrub,
+    "scrubStoredCredentialFromTranscripts",
+  ).mockImplementation(async () => ({
+    dbMessagesScrubbed: 0,
+    residentMessagesScrubbed: 0,
+  }));
+  syncSpy = spyOn(manualToken, "syncManualTokenConnection").mockImplementation(
+    async () => {},
+  );
+});
+
+afterEach(() => {
+  setSpy.mockRestore();
+  getSpy.mockRestore();
+  scrubSpy.mockRestore();
+  syncSpy.mockRestore();
+});
+
+afterAll(() => {
+  _setMetadataPath(null);
+  if (existsSync(TEST_DIR)) {
+    rmSync(TEST_DIR, { recursive: true });
+  }
+});
+
+describe("storeCredential", () => {
+  test("creates a credential from a service/field ref", async () => {
+    const stored = await asPlugin(() =>
+      storeCredential("openai/acme", "sk-secret"),
+    );
+
+    expect(stored.service).toBe("openai");
+    expect(stored.field).toBe(PLUGIN);
+    expect(stored.credentialId).toBeTruthy();
+    expect(secureStore.get(credentialKey("openai", "acme"))).toBe("sk-secret");
+    expect(getCredentialMetadata("openai", "acme")?.credentialId).toBe(
+      stored.credentialId,
+    );
+  });
+
+  test("stores a value that resolveCredential reads back", async () => {
+    await asPlugin(() => storeCredential("openai/acme", "sk-secret"));
+    await expect(
+      asPlugin(() => resolveCredential("openai/acme")),
+    ).resolves.toBe("sk-secret");
+  });
+
+  test("trims edge whitespace from the value", async () => {
+    await asPlugin(() => storeCredential("openai/acme", "  sk-secret\n"));
+    expect(secureStore.get(credentialKey("openai", "acme"))).toBe("sk-secret");
+  });
+
+  test("records label and description on the credential metadata", async () => {
+    await asPlugin(() =>
+      storeCredential("openai/acme", "sk-secret", {
+        label: "Acme key",
+        description: "Used by the acme plugin",
+      }),
+    );
+
+    const metadata = getCredentialMetadata("openai", "acme");
+    expect(metadata?.alias).toBe("Acme key");
+    expect(metadata?.usageDescription).toBe("Used by the acme plugin");
+  });
+
+  test("replaces the value of an existing credential named by UUID", async () => {
+    const first = await asPlugin(() =>
+      storeCredential("openai/acme", "sk-old"),
+    );
+    const second = await asPlugin(() =>
+      storeCredential(first.credentialId, "sk-new"),
+    );
+
+    expect(second).toEqual(first);
+    expect(secureStore.get(credentialKey("openai", "acme"))).toBe("sk-new");
+  });
+
+  test("rejects a ref that names no credential and is not service/field", async () => {
+    await expect(
+      asPlugin(() => storeCredential("openai", "sk-secret")),
+    ).rejects.toBeInstanceOf(CredentialStoreError);
+    expect(setSpy).not.toHaveBeenCalled();
+  });
+
+  test("rejects an empty value", async () => {
+    await expect(
+      asPlugin(() => storeCredential("openai/acme", "   ")),
+    ).rejects.toThrow(/value is required/);
+    expect(setSpy).not.toHaveBeenCalled();
+  });
+
+  test("surfaces a failed secure-backend write", async () => {
+    writeSucceeds = false;
+    await expect(
+      asPlugin(() => storeCredential("openai/acme", "sk-secret")),
+    ).rejects.toThrow(CredentialStoreError);
+    expect(getCredentialMetadata("openai", "acme")).toBeUndefined();
+  });
+
+  test("scrubs the stored value from recent transcripts", async () => {
+    await asPlugin(() => storeCredential("openai/acme", "sk-secret"));
+    expect(scrubSpy).toHaveBeenCalledWith("sk-secret");
+  });
+
+  test("skips the transcript scrub when asked", async () => {
+    await asPlugin(() =>
+      storeCredential("openai/acme", "sk-secret", {
+        skipTranscriptScrub: true,
+      }),
+    );
+    expect(scrubSpy).not.toHaveBeenCalled();
+  });
+
+  test("reconciles the manual-token connection for the service", async () => {
+    await asPlugin(() => storeCredential("openai/acme", "sk-secret"));
+    expect(syncSpy).toHaveBeenCalledWith("openai");
+  });
+
+  describe("plugin scoping", () => {
+    test("fails closed with no plugin in context", async () => {
+      // A plugin's module body is evaluated outside any context. An unscoped
+      // branch there would let top-level code overwrite the user's own
+      // credentials, so the write is refused instead.
+      await expect(storeCredential("openai/acme", "sk-secret")).rejects.toThrow(
+        /requires an active plugin execution context/,
+      );
+      expect(setSpy).not.toHaveBeenCalled();
+      expect(getCredentialMetadata("openai", "acme")).toBeUndefined();
+    });
+
+    test("blocks a plugin from storing a credential whose field differs from its name", async () => {
+      await expect(
+        asPlugin(() => storeCredential("openai/api_key", "sk-secret")),
+      ).rejects.toThrow(/out of scope/);
+    });
+
+    test("does not write the secure backend when out of scope", async () => {
+      await expect(
+        asPlugin(() => storeCredential("openai/api_key", "sk-secret")),
+      ).rejects.toThrow(CredentialStoreError);
+      expect(setSpy).not.toHaveBeenCalled();
+      expect(getCredentialMetadata("openai", "api_key")).toBeUndefined();
+    });
+
+    test("blocks a plugin from overwriting another credential by UUID", async () => {
+      // Seeded through the host write path, the way the user's own credential
+      // is created (`credentials set`), not through the plugin API.
+      const existing = await storeCredentialValue({
+        service: "openai",
+        field: "api_key",
+        value: "sk-user",
+        skipTranscriptScrub: true,
+      });
+      setSpy.mockClear();
+
+      await expect(
+        asPlugin(() => storeCredential(existing.credentialId, "sk-hijacked")),
+      ).rejects.toThrow(/out of scope/);
+      expect(setSpy).not.toHaveBeenCalled();
+      expect(secureStore.get(credentialKey("openai", "api_key"))).toBe(
+        "sk-user",
+      );
+    });
+
+    test("scoping applies by field only, across any service", async () => {
+      await asPlugin(async () => {
+        await storeCredential("stripe/acme", "stripe-secret");
+        await storeCredential("openai/acme", "openai-secret");
+      });
+
+      expect(secureStore.get(credentialKey("stripe", "acme"))).toBe(
+        "stripe-secret",
+      );
+      expect(secureStore.get(credentialKey("openai", "acme"))).toBe(
+        "openai-secret",
+      );
+    });
+  });
+});