@vellumai/assistant 0.11.4-dev.202608201710.fcf0423 → 0.11.4-dev.202608201915.5ca6ffa

package/openapi.yaml

@@ -9886,7 +9886,10 @@ paths:
     post:
       operationId: credentials_delete_post
       summary: Delete a credential
-      description: Remove a secret, its metadata, and any associated OAuth connection from the vault.
+      description:
+        Remove a secret, its metadata, and any associated OAuth connection from the vault. Refused with
+        CREDENTIAL_IN_USE while an LLM provider connection resolves its auth through the credential, unless `force` is
+        set.
       tags:
         - credentials
       requestBody:
@@ -9902,6 +9905,9 @@ paths:
                 field:
                   type: string
                   description: Field name
+                force:
+                  description: Delete even when provider connections depend on the credential
+                  type: boolean
               required:
                 - service
                 - field
@@ -9917,9 +9923,15 @@ paths:
                     type: string
                   field:
                     type: string
+                  affectedConnections:
+                    type: array
+                    items:
+                      type: string
+                    description: Provider connections that depended on the deleted credential
                 required:
                   - service
                   - field
+                  - affectedConnections
                 additionalProperties: false
   /v1/credentials/inspect:
     post:
@@ -27991,7 +28003,9 @@ paths:
     delete:
       operationId: secrets_delete
       summary: Delete a secret
-      description: Remove a secret from the credential vault by name.
+      description:
+        Remove a secret from the credential vault by name. Refused with CREDENTIAL_IN_USE while an LLM provider
+        connection resolves its auth through the credential, unless `force` is set.
       tags:
         - secrets
       requestBody:
@@ -28007,6 +28021,9 @@ paths:
                 name:
                   type: string
                   description: Name of the secret to delete
+                force:
+                  description: Delete even when provider connections depend on the credential
+                  type: boolean
               required:
                 - type
                 - name

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.4-dev.202608201710.fcf0423",
+  "version": "0.11.4-dev.202608201915.5ca6ffa",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/credential-routes.test.ts

@@ -146,6 +146,7 @@ mock.module("../tools/credentials/broker.js", () => ({
 }));
 
 import { persistPromptedCredential } from "../credential-execution/prompted-credential.js";
+import { initializeDb } from "../persistence/db-init.js";
 import {
   forChatMintsSince,
   resetForChatMintRegistryForTest,
@@ -158,6 +159,12 @@ import {
 } from "../runtime/reveal-success-registry.js";
 import { ROUTES } from "../runtime/routes/credential-routes.js";
 
+// A delete looks up the provider connections that resolve their auth through
+// the credential, so the inference schema has to exist. No connection is
+// created here: the refusal is covered by
+// runtime/routes/__tests__/credential-delete-in-use.test.ts.
+await initializeDb();
+
 const setRoute = ROUTES.find((r) => r.operationId === "credentials_set");
 const listRoute = ROUTES.find((r) => r.operationId === "credentials_list");
 const deleteRoute = ROUTES.find((r) => r.operationId === "credentials_delete");
@@ -173,7 +180,11 @@ type ListResponse = {
   }>;
   managedCredentials: unknown[];
 };
-type DeleteResponse = { service: string; field: string };
+type DeleteResponse = {
+  service: string;
+  field: string;
+  affectedConnections: string[];
+};
 
 const SECRET_VALUE = "super-secret-token-value";
 
@@ -786,7 +797,11 @@ describe("credentials routes", () => {
       })) as DeleteResponse;
 
       // THEN the response echoes the identifiers
-      expect(result).toEqual({ service: "vercel", field: "api_token" });
+      expect(result).toEqual({
+        service: "vercel",
+        field: "api_token",
+        affectedConnections: [],
+      });
 
       // AND the secret and metadata are gone
       expect(secureStore.has("vercel:api_token")).toBe(false);
@@ -811,7 +826,11 @@ describe("credentials routes", () => {
       })) as DeleteResponse;
 
       // THEN the response echoes the identifiers
-      expect(result).toEqual({ service: "slack_channel", field: "user_token" });
+      expect(result).toEqual({
+        service: "slack_channel",
+        field: "user_token",
+        affectedConnections: [],
+      });
 
       // AND only the user_token is removed; bot + app tokens remain
       expect(secureStore.has("slack_channel:user_token")).toBe(false);

package/src/__tests__/credential-security-invariants.test.ts

@@ -237,7 +237,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "tools/network/web-fetch.ts", // Firecrawl /scrape BYOK fetch provider API key lookup (firecrawl provider key)
       "workspace/default-provider-ensure.ts", // legacy anthropic echo disambiguation (vault key presence check)
       "providers/inference/connection-availability.ts", // shared (provider, connection) availability status (credential presence check only; value never leaves the helper)
-      "plugin-api/resolve-credential.ts", // plugin-facing resolveCredential — reveal-equivalent plaintext read, scoped to the in-context plugin's own field
+      "plugin-api/resolve-credential.ts", // plugin-facing resolveCredential: reveal-equivalent plaintext read, scoped to the in-context plugin's own service
       "tools/credentials/store.ts", // shared credential write path (setSecureKeyAsync only; no reads) behind credentials/set and plugin-facing storeCredential
     ]);
 

package/src/__tests__/daemon-credential-client.test.ts

@@ -104,6 +104,60 @@ describe("daemon credential client", () => {
       expect(result.error).toBe("Credential store is unreachable");
     });
 
+    test("refuses to delete around the in-use guard when the daemon is down", async () => {
+      /**
+       * The guard runs daemon-side, so a stopped daemon must not turn into an
+       * unchecked direct delete.
+       */
+
+      // GIVEN a stored credential and no reachable daemon
+      _ipcResponse = {
+        ok: false,
+        error: "Could not connect to assistant daemon. Is it running?",
+      };
+      await setSecureKeyViaDaemon("api_key", "guarded-provider", "keep-me");
+
+      // WHEN the delete is attempted without force
+      const result = await deleteSecureKeyViaDaemon(
+        "api_key",
+        "guarded-provider",
+      );
+
+      // THEN it is refused and the credential survives
+      expect(result.result).toBe("error");
+      expect(result.code).toBe("IN_USE_CHECK_UNAVAILABLE");
+      expect(result.error).toContain("--force");
+      expect(
+        await getSecureKeyAsync(credentialKey("guarded-provider", "api_key")),
+      ).toBe("keep-me");
+    });
+
+    test("deletes directly when the caller forces past the unavailable guard", async () => {
+      /**
+       * An explicit --force still works with the daemon down.
+       */
+
+      // GIVEN a stored credential and no reachable daemon
+      _ipcResponse = {
+        ok: false,
+        error: "Could not connect to assistant daemon. Is it running?",
+      };
+      await setSecureKeyViaDaemon("api_key", "forced-provider", "drop-me");
+
+      // WHEN the delete is forced
+      const result = await deleteSecureKeyViaDaemon(
+        "api_key",
+        "forced-provider",
+        true,
+      );
+
+      // THEN the credential is gone from secure storage
+      expect(result.result).toBe("deleted");
+      expect(
+        await getSecureKeyAsync(credentialKey("forced-provider", "api_key")),
+      ).toBeUndefined();
+    });
+
     test("returns not-found for 404 errors", async () => {
       _ipcResponse = {
         ok: false,
@@ -167,5 +221,39 @@ describe("daemon credential client", () => {
         body: { type: "credential", name: "github-app:pem" },
       });
     });
+
+    test("delete carries the caller's force choice past the in-use guard", async () => {
+      // GIVEN a daemon that accepts the delete
+      _ipcResponse = { ok: true, result: { success: true } };
+      _lastIpcCall = null;
+
+      // WHEN the caller forces the delete
+      await deleteSecureKeyViaDaemon("api_key", "agentrouter", true);
+
+      // THEN `force` rides along in the request body
+      const captured = _lastIpcCall as {
+        method: string;
+        params: unknown;
+      } | null;
+      expect(captured?.params).toEqual({
+        body: { type: "api_key", name: "agentrouter", force: true },
+      });
+    });
+
+    test("delete surfaces the in-use refusal from the daemon", async () => {
+      // GIVEN a credential an LLM provider connection resolves its auth through
+      _ipcResponse = {
+        ok: false,
+        error:
+          'Credential credential/agentrouter/api_key is in use by connection "agentrouter". It will stop working without it. Delete it anyway to continue.',
+      };
+
+      // WHEN the delete is attempted without force
+      const result = await deleteSecureKeyViaDaemon("api_key", "agentrouter");
+
+      // THEN the refusal reaches the caller naming the dependent connection
+      expect(result.result).toBe("error");
+      expect(result.error).toContain('in use by connection "agentrouter"');
+    });
   });
 });

package/src/__tests__/dm-backfill.test.ts

@@ -587,4 +587,35 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     const texts = rows.map((r) => r.content).sort();
     expect(texts).toEqual(["older A", "older B", "older D"]);
   });
+
+  test("backfill refuses history rows carrying a secret, keeping the rest", async () => {
+    const leakedKey = "AKIA3H7QWERTY9MNBVC2";
+    backfillDmMock.mockImplementation(async () => [
+      makeBackfilledMessage({
+        id: "1700000000.000001",
+        text: "ordinary older chatter",
+      }),
+      makeBackfilledMessage({
+        id: "1700000000.000002",
+        text: `here is the access key ${leakedKey} for the deploy`,
+      }),
+    ]);
+
+    await handleChannelInbound(
+      buildDmRequest("live new DM"),
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
+
+    const rows = readPersistedSlackRows();
+    expect(rows.map((r) => r.content)).toEqual(["ordinary older chatter"]);
+    // `rawContent`, not `content`: the latter is unwrapped by the test
+    // helper, so only the raw column proves what reached storage.
+    for (const row of rows) {
+      expect(row.rawContent).not.toContain(leakedKey);
+    }
+    expect(
+      rows.some((r) => r.slackMeta?.channelTs === "1700000000.000002"),
+    ).toBe(false);
+  });
 });

package/src/__tests__/input-repairs.test.ts

@@ -0,0 +1,207 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import type { SkillToolEntry } from "../config/skills.js";
+import {
+  bundledToolInputAliases,
+  bundledToolInputRepairs,
+} from "../tools/shared/input-repairs.js";
+
+const TOOL = "scaffold_managed_skill";
+const FIND_TOOL = "find_similar_skills";
+
+/** The real manifest entries the repairs describe. */
+function manifestEntry(name: string): SkillToolEntry {
+  const manifest = JSON.parse(
+    readFileSync(
+      join(
+        import.meta.dir,
+        "../config/bundled-skills/skill-management/TOOLS.json",
+      ),
+      "utf-8",
+    ),
+  ) as { tools: SkillToolEntry[] };
+  const entry = manifest.tools.find((t) => t.name === name);
+  if (!entry) {
+    throw new Error(`${name} is missing from the skill-management TOOLS.json`);
+  }
+  return entry;
+}
+
+function declaredProperties(name: string): Record<string, { type?: string }> {
+  const schema = manifestEntry(name).input_schema as {
+    properties: Record<string, { type?: string }>;
+  };
+  return schema.properties;
+}
+
+describe("bundledToolInputRepairs: parameter aliases", () => {
+  test("reads `body` as the declared `body_markdown`", () => {
+    const result = bundledToolInputRepairs(TOOL, {
+      skill_id: "deploy",
+      body: "# Deploy\n",
+    });
+    expect(result).toEqual({ skill_id: "deploy", body_markdown: "# Deploy\n" });
+    expect("body" in result).toBe(false);
+  });
+
+  test("never overwrites a call that spells the parameter correctly", () => {
+    const input = { body: "alias", body_markdown: "declared" };
+    const result = bundledToolInputRepairs(TOOL, input);
+    expect(result).toBe(input);
+  });
+
+  test("leaves a tool with no alias table alone", () => {
+    const input = { body: "# Deploy\n" };
+    expect(bundledToolInputRepairs("file_write", input)).toBe(input);
+  });
+
+  test.each([TOOL, FIND_TOOL])(
+    "%s: no alias shadows a parameter the tool declares",
+    (tool) => {
+      const declared = declaredProperties(tool);
+      const aliases = bundledToolInputAliases(tool);
+      expect(aliases.length).toBeGreaterThan(0);
+      for (const alias of aliases) {
+        expect(declared[alias]).toBeUndefined();
+      }
+    },
+  );
+
+  test.each([TOOL, FIND_TOOL])(
+    "%s: every alias targets a parameter the tool declares",
+    (tool) => {
+      const declared = declaredProperties(tool);
+      for (const alias of bundledToolInputAliases(tool)) {
+        const result = bundledToolInputRepairs(tool, { [alias]: "value" });
+        const target = Object.keys(result).find((key) => key !== alias);
+        expect(target).toBeDefined();
+        expect(declared[target!]).toBeDefined();
+      }
+    },
+  );
+
+  test.each([
+    ["title", "name"],
+    ["summary", "description"],
+    ["content", "body_markdown"],
+  ])("reads `%s` as `%s`", (alias, canonical) => {
+    const result = bundledToolInputRepairs(TOOL, { [alias]: "value" });
+    expect(result).toEqual({ [canonical]: "value" });
+  });
+
+  test.each(["description", "query"])(
+    "find_similar_skills reads `%s` as `goal`",
+    (alias) => {
+      const result = bundledToolInputRepairs(FIND_TOOL, {
+        [alias]: "deploy staging",
+      });
+      expect(result).toEqual({ goal: "deploy staging" });
+    },
+  );
+});
+
+describe("bundledToolInputRepairs: files written as a path-keyed map", () => {
+  test("reads string values as each file's contents", () => {
+    const result = bundledToolInputRepairs(TOOL, {
+      files: {
+        "references/failure-modes.md": "The retry loop stalls.",
+        "scripts/run.sh": "echo hi",
+      },
+    });
+    expect(result.files).toEqual([
+      {
+        path: "references/failure-modes.md",
+        content: "The retry loop stalls.",
+      },
+      { path: "scripts/run.sh", content: "echo hi" },
+    ]);
+  });
+
+  test("reads an entry that names content or copy_from", () => {
+    const result = bundledToolInputRepairs(TOOL, {
+      files: {
+        "references/notes.md": { content: "hi" },
+        "scripts/run.sh": { copy_from: "/tmp/run.sh" },
+      },
+    });
+    expect(result.files).toEqual([
+      { path: "references/notes.md", content: "hi" },
+      { path: "scripts/run.sh", copy_from: "/tmp/run.sh" },
+    ]);
+  });
+
+  test("leaves one entry spelling out its own fields, which is a file not a map", () => {
+    const input = { files: { path: "references/notes.md", content: "hi" } };
+    expect(bundledToolInputRepairs(TOOL, input)).toBe(input);
+  });
+
+  test("leaves the whole value when any entry is unreadable", () => {
+    const input = {
+      files: {
+        "references/notes.md": "hi",
+        "scripts/run.sh": { mode: 755 },
+      },
+    };
+    expect(bundledToolInputRepairs(TOOL, input)).toBe(input);
+  });
+
+  test("leaves a map with a blank path", () => {
+    const input = { files: { "   ": "hi" } };
+    expect(bundledToolInputRepairs(TOOL, input)).toBe(input);
+  });
+
+  test("leaves an empty object", () => {
+    const input = { files: {} };
+    expect(bundledToolInputRepairs(TOOL, input)).toBe(input);
+  });
+
+  test("an entry spelling out every declared file property is read as one file", () => {
+    const schema = manifestEntry(TOOL).input_schema as {
+      properties: {
+        files: { items: { properties: Record<string, unknown> } };
+      };
+    };
+    const declared = Object.keys(schema.properties.files.items.properties);
+    expect(declared).toContain("path");
+    const entry = Object.fromEntries(declared.map((key) => [key, "value"]));
+
+    const input = { files: entry };
+    expect(bundledToolInputRepairs(TOOL, input)).toBe(input);
+  });
+
+  test("leaves files that already arrived as an array", () => {
+    const input = { files: [{ path: "references/notes.md", content: "hi" }] };
+    expect(bundledToolInputRepairs(TOOL, input)).toBe(input);
+  });
+});
+
+describe("bundledToolInputRepairs: purity", () => {
+  test("returns the same object when there is nothing to repair", () => {
+    const input = { skill_id: "deploy", body_markdown: "# Deploy\n" };
+    expect(bundledToolInputRepairs(TOOL, input)).toBe(input);
+  });
+
+  test("returns a new object and never mutates the original input", () => {
+    const input = {
+      body: "# Deploy\n",
+      files: { "references/notes.md": "hi" },
+    };
+    const snapshot = JSON.parse(JSON.stringify(input));
+    const result = bundledToolInputRepairs(TOOL, input);
+    expect(result).not.toBe(input);
+    expect(input).toEqual(snapshot);
+  });
+
+  test("repairs an alias and a files map in the same call", () => {
+    const result = bundledToolInputRepairs(TOOL, {
+      body: "# Deploy\n",
+      files: { "references/notes.md": "hi" },
+    });
+    expect(result).toEqual({
+      body_markdown: "# Deploy\n",
+      files: [{ path: "references/notes.md", content: "hi" }],
+    });
+  });
+});

package/src/__tests__/plugin-api-resolve-credential.test.ts

@@ -102,21 +102,28 @@ describe("resolveCredential", () => {
   });
 
   describe("plugin scoping", () => {
-    test("allows a plugin to resolve a credential whose field matches its name", async () => {
-      seedCredential("openai", "acme", "scoped-secret");
-      const value = await runInPluginContext("acme", () =>
-        resolveCredential("openai/acme"),
+    test("allows a plugin to resolve a credential whose service matches its name", async () => {
+      seedCredential("imessage", "api_key", "comms-key");
+      const value = await runInPluginContext("imessage", () =>
+        resolveCredential("imessage/api_key"),
       );
-      expect(value).toBe("scoped-secret");
+      expect(value).toBe("comms-key");
     });
 
-    test("blocks a plugin from resolving a credential whose field differs from its name", async () => {
+    test("blocks a plugin from resolving another service", async () => {
       seedCredential("openai", "api_key", "sk-secret");
       await expect(
         runInPluginContext("acme", () => resolveCredential("openai/api_key")),
       ).rejects.toThrow(/out of scope/);
     });
 
+    test("blocks a plugin from resolving another service even when the field matches its name", async () => {
+      seedCredential("openai", "acme", "scoped-secret");
+      await expect(
+        runInPluginContext("acme", () => resolveCredential("openai/acme")),
+      ).rejects.toThrow(/out of scope/);
+    });
+
     test("does not read the secure backend when out of scope", async () => {
       seedCredential("openai", "api_key", "sk-secret");
       getSpy.mockClear();
@@ -126,15 +133,17 @@ describe("resolveCredential", () => {
       expect(getSpy).not.toHaveBeenCalled();
     });
 
-    test("scoping applies by field only, across any service", async () => {
-      seedCredential("stripe", "acme", "stripe-secret");
-      seedCredential("openai", "acme", "openai-secret");
+    test("scoping applies to every field under the plugin's service", async () => {
+      seedCredential("imessage", "api_key", "comms-key");
+      seedCredential("imessage", "photon_project_id", "proj-id");
       await expect(
-        runInPluginContext("acme", () => resolveCredential("stripe/acme")),
-      ).resolves.toBe("stripe-secret");
+        runInPluginContext("imessage", () => resolveCredential("imessage/api_key")),
+      ).resolves.toBe("comms-key");
       await expect(
-        runInPluginContext("acme", () => resolveCredential("openai/acme")),
-      ).resolves.toBe("openai-secret");
+        runInPluginContext("imessage", () =>
+          resolveCredential("imessage/photon_project_id"),
+        ),
+      ).resolves.toBe("proj-id");
     });
   });
 });