@vellumai/assistant 0.11.4-dev.202608202309.2fd95bc → 0.11.4-dev.202608210133.5377df0

package/node_modules/@vellumai/gateway-client/src/outbound-contract.ts

@@ -175,8 +175,6 @@ export const ChannelReplyPayloadSchema = z.object({
   ephemeral: z.boolean().optional(),
   /** Slack user ID — required when `ephemeral` is true. */
   user: z.string().optional(),
-  /** When provided, update an existing message instead of posting a new one. */
-  messageTs: z.string().optional(),
   /** When true, the daemon generates Block Kit blocks from the text before delivery. */
   useBlocks: z.boolean().optional(),
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.4-dev.202608202309.2fd95bc",
+  "version": "0.11.4-dev.202608210133.5377df0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/anthropic-provider.test.ts

@@ -160,6 +160,13 @@ function cachedPrefixBlock(text: string): ContentBlock {
   } as unknown as ContentBlock;
 }
 
+/**
+ * A 1x1 PNG. The send boundary validates image bytes before serialization, so
+ * an image fixture has to carry a real signature to reach the wire.
+ */
+const PNG_B64 =
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFAAH/q842iQAAAABJRU5ErkJggg==";
+
 const sampleTools: ToolDefinition[] = [
   {
     name: "file_read",
@@ -2754,7 +2761,7 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
                 source: {
                   type: "base64",
                   media_type: "image/png",
-                  data: "iVBOR",
+                  data: PNG_B64,
                 },
               },
               { type: "text", text: "extra error detail" },
@@ -2806,7 +2813,7 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
                 source: {
                   type: "base64",
                   media_type: "image/png",
-                  data: "iVBOR",
+                  data: PNG_B64,
                 },
               },
             ],
@@ -2853,7 +2860,7 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
                 source: {
                   type: "base64",
                   media_type: "image/png",
-                  data: "iVBOR",
+                  data: PNG_B64,
                 },
               },
             ],

package/src/__tests__/channel-reply-delivery.test.ts

@@ -58,6 +58,19 @@ const renderedHistoryContentQueue: RenderedHistoryStub[] = [];
 
 let deliveryFailAtIndex = -1;
 
+const editCalls: { callbackUrl: string; target: Record<string, unknown> }[] =
+  [];
+
+mock.module("../messaging/providers/index.js", () => ({
+  editChannelMessage: async (
+    callbackUrl: string,
+    target: Record<string, unknown>,
+  ) => {
+    editCalls.push({ callbackUrl, target });
+    return { ok: true };
+  },
+}));
+
 mock.module("../runtime/gateway-client.js", () => ({
   deliverChannelReply: async (
     callbackUrl: string,
@@ -784,8 +797,9 @@ describe("channel-reply-delivery", () => {
       assistantId: undefined,
       ephemeral: undefined,
       user: undefined,
-      messageTs: "1700000000.000055",
     });
+    // Attachments post as new messages, so nothing is edited on this path.
+    expect(editCalls).toHaveLength(0);
     expect(seenTs).toEqual(["1700000000.000055"]);
   });
 

package/src/__tests__/conversation-error.test.ts

@@ -521,6 +521,23 @@ describe("classifyConversationError", () => {
       expect(result.userMessage.toLowerCase()).toContain("image");
     });
 
+    it("classifies an OpenAI-compatible 400 for an unreadable image as image_unsupported_format (non-retryable)", () => {
+      // The rejection an OpenAI-compatible endpoint returns when any image in
+      // the request is not one of the formats it decodes (a HEIC photo renamed
+      // to .png, say). It names no index, so the whole turn dies unless it is
+      // classified for the image-recovery path with actionable copy.
+      const err = new ProviderError(
+        "The image data you provided does not represent a valid image. Please check your input and try again with one of the supported image formats: [image/jpeg, image/png, image/gif, image/webp]",
+        "openai",
+        400,
+      );
+      const result = classifyConversationError(err, baseCtx);
+      expect(result.code).toBe("IMAGE_TOO_LARGE");
+      expect(result.errorCategory).toBe("image_unsupported_format");
+      expect(result.retryable).toBe(false);
+      expect(result.userMessage.toLowerCase()).toContain("image");
+    });
+
     it("does not steal generic 400s that happen to mention 'image'", () => {
       const err = new ProviderError(
         "invalid request: image source is missing",

package/src/__tests__/file-write-tool.test.ts

@@ -76,8 +76,10 @@ beforeEach(() => {
   enqueueCalls.length = 0;
   enqueueThrows = false;
   // Reset to a stable tmp path so the sandbox tests (which don't use pkb/)
-  // deterministically land outside any configured PKB root.
-  process.env.VELLUM_WORKSPACE_DIR = tmpdir();
+  // deterministically land outside any configured PKB root. A subdirectory
+  // rather than tmpdir() itself, so vellumRoot() (the parent) also stays
+  // inside the temp directory for the live-workspace guard.
+  process.env.VELLUM_WORKSPACE_DIR = join(tmpdir(), "file-write-tool-ws");
 });
 
 afterEach(() => {

package/src/__tests__/host-shell-tool.test.ts

@@ -678,6 +678,14 @@ describe("host_bash — spawn error handling", () => {
 // ---------------------------------------------------------------------------
 
 describe("host_bash — proxy delegation", () => {
+  // Under tmpdir so the live-workspace guard accepts it as a workspace.
+  const FAKE_INSTANCE_WS = join(
+    tmpdir(),
+    "vellum-instance",
+    ".vellum",
+    "workspace",
+  );
+
   const ROUTING_ENV_KEYS = [
     "VELLUM_WORKSPACE_DIR",
     "VELLUM_DATA_DIR",
@@ -850,6 +858,11 @@ describe("host_bash — proxy delegation", () => {
     for (const key of ROUTING_ENV_KEYS) {
       delete process.env[key];
     }
+    // With VELLUM_WORKSPACE_DIR unset, loadConfig resolves the real ~/.vellum
+    // fallback (read-only here), so bypass the live-workspace guard for it.
+    const originalAllowRealWorkspace =
+      process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+    process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS = "1";
 
     try {
       const proxyResult: ToolExecutionResult = {
@@ -870,14 +883,20 @@ describe("host_bash — proxy delegation", () => {
         __REVEAL_NONCE: expect.any(String),
       });
     } finally {
+      if (originalAllowRealWorkspace === undefined) {
+        delete process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+      } else {
+        process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS =
+          originalAllowRealWorkspace;
+      }
       restoreEnv(envSnapshot);
     }
   });
 
   test("propagates daemon routing env vars to proxy for nested assistant CLI calls", async () => {
     const envSnapshot = captureEnv(ROUTING_ENV_KEYS);
-    process.env.VELLUM_WORKSPACE_DIR = "/tmp/vellum-instance/.vellum/workspace";
-    process.env.VELLUM_DATA_DIR = "/tmp/vellum-instance/.vellum/workspace/data";
+    process.env.VELLUM_WORKSPACE_DIR = FAKE_INSTANCE_WS;
+    process.env.VELLUM_DATA_DIR = join(FAKE_INSTANCE_WS, "data");
     process.env.VELLUM_ENVIRONMENT = "local";
     process.env.INTERNAL_GATEWAY_BASE_URL = "http://127.0.0.1:7830";
 
@@ -896,8 +915,8 @@ describe("host_bash — proxy delegation", () => {
       expect(result).toBe(proxyResult);
       expect(calls.length).toBe(1);
       expect(calls[0].input.env).toEqual({
-        VELLUM_WORKSPACE_DIR: "/tmp/vellum-instance/.vellum/workspace",
-        VELLUM_DATA_DIR: "/tmp/vellum-instance/.vellum/workspace/data",
+        VELLUM_WORKSPACE_DIR: FAKE_INSTANCE_WS,
+        VELLUM_DATA_DIR: join(FAKE_INSTANCE_WS, "data"),
         VELLUM_ENVIRONMENT: "local",
         INTERNAL_GATEWAY_BASE_URL: "http://127.0.0.1:7830",
         __CONVERSATION_ID: "test-conversation",

package/src/__tests__/live-workspace-guard.test.ts

@@ -0,0 +1,75 @@
+/**
+ * Tests for the live-workspace guard in util/platform.ts: a test process must
+ * never resolve the workspace to a directory outside os.tmpdir().
+ */
+
+import { rmSync, symlinkSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { getWorkspaceDir } from "../util/platform.js";
+
+const originalWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR;
+const originalAllowReal = process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+
+afterEach(() => {
+  process.env.VELLUM_WORKSPACE_DIR = originalWorkspaceDir;
+  if (originalAllowReal === undefined) {
+    delete process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+  } else {
+    process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS = originalAllowReal;
+  }
+});
+
+describe("live-workspace guard", () => {
+  test("allows the preload's tmpdir workspace", () => {
+    expect(getWorkspaceDir()).toBe(process.env.VELLUM_WORKSPACE_DIR!);
+  });
+
+  test("allows a not-yet-created nested path under tmpdir", () => {
+    const dir = join(
+      tmpdir(),
+      "vellum-guard-nonexistent",
+      "nested",
+      "workspace",
+    );
+    process.env.VELLUM_WORKSPACE_DIR = dir;
+    expect(getWorkspaceDir()).toBe(dir);
+  });
+
+  test("refuses a non-tmpdir workspace in a test process", () => {
+    delete process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+    process.env.VELLUM_WORKSPACE_DIR = join(homedir(), "vellum-guard-live");
+    expect(() => getWorkspaceDir()).toThrow(/Refusing to use/);
+  });
+
+  test("refuses a tmpdir symlink that resolves outside tmpdir", () => {
+    delete process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+    const link = join(tmpdir(), `vellum-guard-escape-${process.pid}`);
+    rmSync(link, { force: true });
+    symlinkSync(homedir(), link);
+    try {
+      process.env.VELLUM_WORKSPACE_DIR = link;
+      expect(() => getWorkspaceDir()).toThrow(/Refusing to use/);
+    } finally {
+      rmSync(link, { force: true });
+    }
+  });
+
+  test("VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS=1 bypasses the guard", () => {
+    const dir = join(homedir(), "vellum-guard-live-optout");
+    process.env.VELLUM_WORKSPACE_DIR = dir;
+    process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS = "1";
+    expect(getWorkspaceDir()).toBe(dir);
+  });
+
+  test("opt-out is per-call, not cached: same dir throws once the var clears", () => {
+    const dir = join(homedir(), "vellum-guard-live-optout-cleared");
+    process.env.VELLUM_WORKSPACE_DIR = dir;
+    process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS = "1";
+    expect(getWorkspaceDir()).toBe(dir);
+    delete process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+    expect(() => getWorkspaceDir()).toThrow(/Refusing to use/);
+  });
+});

package/src/__tests__/mcp-abort-signal.test.ts

@@ -12,7 +12,7 @@ mock.module("../config/env-registry.js", () => ({
   getIsContainerized: () => false,
   getIsPlatform: () => false,
   isPlatformRemote: () => false,
-  getWorkspaceDirOverride: () => undefined,
+  getWorkspaceDirOverride: () => process.env.VELLUM_WORKSPACE_DIR,
   getBackupDirOverride: () => undefined,
   getBackupKeyPathOverride: () => undefined,
   getCpuLimit: () => undefined,

package/src/__tests__/mcp-client-auth.test.ts

@@ -12,7 +12,7 @@ mock.module("../config/env-registry.js", () => ({
   getIsContainerized: () => false,
   getIsPlatform: () => false,
   isPlatformRemote: () => false,
-  getWorkspaceDirOverride: () => undefined,
+  getWorkspaceDirOverride: () => process.env.VELLUM_WORKSPACE_DIR,
   getBackupDirOverride: () => undefined,
   getBackupKeyPathOverride: () => undefined,
   getCpuLimit: () => undefined,

package/src/__tests__/mcp-tool-annotations-risk.test.ts

@@ -12,7 +12,7 @@ mock.module("../config/env-registry.js", () => ({
   getIsContainerized: () => false,
   getIsPlatform: () => false,
   isPlatformRemote: () => false,
-  getWorkspaceDirOverride: () => undefined,
+  getWorkspaceDirOverride: () => process.env.VELLUM_WORKSPACE_DIR,
   getBackupDirOverride: () => undefined,
   getBackupKeyPathOverride: () => undefined,
   getCpuLimit: () => undefined,

package/src/__tests__/media-resolve-image-validation.test.ts

@@ -0,0 +1,310 @@
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import {
+  unsendableImageCardText,
+  unsendableImageFilenames,
+} from "../daemon/unsendable-image-notice.js";
+import { createInlineAttachment } from "../persistence/attachments-store.js";
+import {
+  addMessage,
+  createConversation,
+} from "../persistence/conversation-crud.js";
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+import {
+  isUnsendableImageSource,
+  resolveMediaReferences,
+  UNSENDABLE_IMAGE_FORMAT_NOTE,
+} from "../providers/media-resolve.js";
+import type { ContentBlock, Message } from "../providers/types.js";
+
+await initializeDb();
+
+function resetTables() {
+  const db = getDb();
+  db.run("DELETE FROM message_attachments");
+  db.run("DELETE FROM attachments");
+  db.run("DELETE FROM messages");
+  db.run("DELETE FROM conversations");
+}
+
+/** A 1x1 PNG: a real signature plus enough body to be a decodable image. */
+const PNG_B64 =
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFAAH/q842iQAAAABJRU5ErkJggg==";
+
+/**
+ * A HEIC head (ISO BMFF `ftyp` + the `heic` brand) under a `.png` name, which
+ * is what a photo renamed by hand or exported by iOS arrives as.
+ */
+const HEIC_B64 = Buffer.from([
+  0x00, 0x00, 0x00, 0x18, 0x66, 0x74, 0x79, 0x70, 0x68, 0x65, 0x69, 0x63, 0x00,
+  0x00, 0x00, 0x00,
+]).toString("base64");
+
+/** A PNG whose signature bytes are damaged, as a partial upload leaves it. */
+const CORRUPT_PNG_B64 = Buffer.from([
+  0x89, 0x50, 0x4e, 0x00, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d,
+]).toString("base64");
+
+function userMessage(content: ContentBlock[]): Message {
+  return { role: "user", content };
+}
+
+function inlineImage(mediaType: string, data: string): ContentBlock {
+  return {
+    type: "image",
+    source: { type: "base64", media_type: mediaType, data },
+  };
+}
+
+async function storedImageRef(
+  filename: string,
+  mimeType: string,
+  dataBase64: string,
+): Promise<ContentBlock> {
+  const conv = createConversation();
+  const stored = await createInlineAttachment(
+    conv.id,
+    conv.createdAt,
+    filename,
+    mimeType,
+    dataBase64,
+  );
+  return {
+    type: "image",
+    source: {
+      type: "workspace_ref",
+      media_type: mimeType,
+      attachmentId: stored.id,
+      sizeBytes: stored.sizeBytes,
+      filename,
+    },
+  };
+}
+
+describe("resolveMediaReferences image validation", () => {
+  beforeEach(resetTables);
+
+  test("sends a valid inline image untouched", async () => {
+    // GIVEN a message carrying an inline PNG whose bytes match its declaration
+    const message = userMessage([inlineImage("image/png", PNG_B64)]);
+
+    // WHEN the send boundary resolves it
+    const [resolved] = await resolveMediaReferences([message]);
+
+    // THEN the block is unchanged, and the message is the same object (no
+    // allocation or disk read on the clean live-turn fast path)
+    expect(resolved).toBe(message);
+  });
+
+  test("drops the unreadable image from a batch and keeps the valid ones", async () => {
+    // GIVEN a batch of a valid PNG, a HEIC photo declared as a PNG, and a
+    // truncated PNG: the shape of the eight-image upload that lost a whole turn
+    const message = userMessage([
+      { type: "text", text: "what is in these?" },
+      inlineImage("image/png", PNG_B64),
+      inlineImage("image/png", HEIC_B64),
+      inlineImage("image/png", CORRUPT_PNG_B64),
+    ]);
+
+    // WHEN the send boundary resolves them
+    const [resolved] = await resolveMediaReferences([message]);
+
+    // THEN the valid image still goes to the model
+    expect(resolved.content[1]).toEqual(inlineImage("image/png", PNG_B64));
+
+    // AND each unreadable image is replaced by a note instead of failing the
+    // whole request
+    expect(resolved.content[2]).toEqual({
+      type: "text",
+      text: UNSENDABLE_IMAGE_FORMAT_NOTE,
+    });
+    expect(resolved.content[3]).toEqual({
+      type: "text",
+      text: UNSENDABLE_IMAGE_FORMAT_NOTE,
+    });
+  });
+
+  test("keeps a HEIC photo for a provider that decodes HEIF", async () => {
+    /**
+     * Gemini reads image/heic and image/heif directly, so an untranscoded HEIC
+     * photo must reach it as an image rather than as an omission note.
+     */
+    // GIVEN a HEIC photo declared as a PNG, as an untranscoded upload arrives
+    const message = userMessage([inlineImage("image/png", HEIC_B64)]);
+
+    // WHEN a provider that accepts HEIF resolves it
+    const [resolved] = await resolveMediaReferences([message], {
+      acceptsHeif: true,
+    });
+
+    // THEN the image survives, declared as the HEIF type its brand names
+    expect(resolved.content[0]).toEqual(inlineImage("image/heic", HEIC_B64));
+  });
+
+  test("relabels an inline image whose declared type is not its actual type", async () => {
+    // GIVEN PNG bytes declared as JPEG, which every provider rejects outright
+    const message = userMessage([inlineImage("image/jpeg", PNG_B64)]);
+
+    // WHEN the send boundary resolves it
+    const [resolved] = await resolveMediaReferences([message]);
+
+    // THEN the declaration is corrected to what the bytes are, payload intact
+    expect(resolved.content[0]).toEqual(inlineImage("image/png", PNG_B64));
+  });
+
+  test("drops a stored image whose bytes are not a readable format", async () => {
+    // GIVEN a persisted attachment holding HEIC bytes under a .png name,
+    // referenced by a reloaded message
+    const block = await storedImageRef("photo.png", "image/png", HEIC_B64);
+
+    // WHEN the send boundary resolves the reference
+    const [resolved] = await resolveMediaReferences([userMessage([block])]);
+
+    // THEN it is replaced by the note rather than hydrated and sent
+    expect(resolved.content[0]).toEqual({
+      type: "text",
+      text: UNSENDABLE_IMAGE_FORMAT_NOTE,
+    });
+  });
+
+  test("keeps the unavailable-attachment note for a reference with no bytes", async () => {
+    // GIVEN a reference to an attachment row that does not exist
+    const block: ContentBlock = {
+      type: "image",
+      source: {
+        type: "workspace_ref",
+        media_type: "image/png",
+        attachmentId: "missing-attachment",
+        sizeBytes: 1024,
+        filename: "gone.png",
+      },
+    };
+
+    // WHEN the send boundary resolves it
+    const [resolved] = await resolveMediaReferences([userMessage([block])]);
+
+    // THEN an unreadable payload is reported as unavailable, not as a bad
+    // format: the file may simply have been collected
+    expect(resolved.content[0]).toEqual({
+      type: "text",
+      text: "[Attachment unavailable: image could not be loaded]",
+    });
+  });
+
+  test("validates images nested in a tool result", async () => {
+    // GIVEN a tool result carrying one readable and one corrupt image
+    const message = userMessage([
+      {
+        type: "tool_result",
+        tool_use_id: "tool-1",
+        content: "two screenshots",
+        contentBlocks: [
+          inlineImage("image/png", PNG_B64),
+          inlineImage("image/png", CORRUPT_PNG_B64),
+        ],
+      },
+    ]);
+
+    // WHEN the send boundary resolves it
+    const [resolved] = await resolveMediaReferences([message]);
+
+    // THEN the tool_use/tool_result pairing survives with the bad image noted
+    const toolResult = resolved.content[0];
+    if (toolResult.type !== "tool_result") {
+      throw new Error(`expected tool_result, got ${toolResult.type}`);
+    }
+    expect(toolResult.contentBlocks).toEqual([
+      inlineImage("image/png", PNG_B64),
+      { type: "text", text: UNSENDABLE_IMAGE_FORMAT_NOTE },
+    ]);
+  });
+});
+
+describe("isUnsendableImageSource", () => {
+  beforeEach(resetTables);
+
+  test("reports a stored attachment the send boundary will drop", async () => {
+    // GIVEN one attachment holding a real PNG and one holding HEIC bytes
+    const good = await storedImageRef("good.png", "image/png", PNG_B64);
+    const bad = await storedImageRef("bad.png", "image/png", HEIC_B64);
+    if (good.type !== "image" || bad.type !== "image") {
+      throw new Error("expected image blocks");
+    }
+
+    // WHEN each source is checked
+    // THEN only the unreadable one is reported, matching what the boundary does
+    expect(isUnsendableImageSource(good.source)).toBe(false);
+    expect(isUnsendableImageSource(bad.source)).toBe(true);
+  });
+
+  test("does not report a reference whose attachment is gone", () => {
+    // GIVEN a reference with no row behind it
+    // WHEN it is checked
+    // THEN it is not called unsendable: a missing payload is a separate
+    // failure, and naming it in the drop card would misinform the user
+    expect(
+      isUnsendableImageSource({
+        type: "workspace_ref",
+        media_type: "image/png",
+        attachmentId: "missing-attachment",
+        sizeBytes: 10,
+        filename: "gone.png",
+      }),
+    ).toBe(false);
+  });
+});
+
+describe("unsendable-image notice", () => {
+  beforeEach(resetTables);
+
+  test("names only the attachments the model cannot see", async () => {
+    // GIVEN a message whose attachments are one valid PNG and one HEIC-as-PNG
+    const msgConv = createConversation();
+    await addMessage(msgConv.id, "user", "look at these");
+    const good = await storedImageRef("holiday.png", "image/png", PNG_B64);
+    const bad = await storedImageRef("beach.png", "image/png", HEIC_B64);
+    if (good.type !== "image" || bad.type !== "image") {
+      throw new Error("expected image blocks");
+    }
+
+    // WHEN the notice decides what to name
+    const filenames = unsendableImageFilenames([
+      { filename: "holiday.png", source: good.source },
+      { filename: "beach.png", source: bad.source },
+    ]);
+
+    // THEN only the dropped file is named, so the user knows which to convert
+    expect(filenames).toEqual(["beach.png"]);
+
+    // AND the card copy names it and says what to do about it
+    expect(unsendableImageCardText(filenames)).toBe(
+      "beach.png was not sent to the model: the file is not a PNG, JPEG, GIF, or WebP image. Convert it and attach it again to include it.",
+    );
+  });
+
+  test("posts no notice when every attachment is readable", async () => {
+    // GIVEN attachments that are all valid images
+    const good = await storedImageRef("one.png", "image/png", PNG_B64);
+    if (good.type !== "image") {
+      throw new Error("expected an image block");
+    }
+
+    // WHEN the notice decides what to name
+    // THEN there is nothing to say, so no card is written
+    expect(
+      unsendableImageFilenames([{ filename: "one.png", source: good.source }]),
+    ).toEqual([]);
+  });
+
+  test("names every dropped file when a batch has several", () => {
+    // GIVEN two inline attachments whose bytes are unreadable
+    // WHEN the card copy is built for them
+    const text = unsendableImageCardText(["a.png", "b.png"]);
+
+    // THEN both are named in plural copy
+    expect(text).toBe(
+      "a.png, b.png were not sent to the model: the files are not PNG, JPEG, GIF, or WebP images. Convert them and attach them again to include them.",
+    );
+  });
+});

package/src/__tests__/platform.test.ts

@@ -1,7 +1,7 @@
 import { existsSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, describe, expect, test } from "bun:test";
 
 import {
   ensureDataDir,
@@ -23,6 +23,21 @@ import {
 } from "../util/platform.js";
 
 const originalWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR;
+
+// This file characterizes path resolution itself (including the ~/.vellum
+// fallback and literal override paths) without reading or writing those
+// locations, so the live-workspace guard is deliberately bypassed.
+const originalAllowRealWorkspace =
+  process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS = "1";
+afterAll(() => {
+  if (originalAllowRealWorkspace === undefined) {
+    delete process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+  } else {
+    process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS =
+      originalAllowRealWorkspace;
+  }
+});
 const originalVellumEnvironment = process.env.VELLUM_ENVIRONMENT;
 const originalXdgConfigHome = process.env.XDG_CONFIG_HOME;
 

package/src/__tests__/plugin-api-shim.test.ts

@@ -136,9 +136,14 @@ describe("ensurePluginApiShim", () => {
         `}));\n`,
     );
 
+    // Explicit env spread: under bun test, a child's default env reflects the
+    // process-start environ, not later process.env mutations. Without this
+    // the child misses the preload's VELLUM_WORKSPACE_DIR and resolves the
+    // real ~/.vellum/workspace (refused by the live-workspace guard).
     const result = spawnSync(process.execPath, ["run", probe], {
       encoding: "utf8",
       timeout: 30_000,
+      env: { ...process.env },
     });
     expect(result.status).toBe(0);
     const lastLine = result.stdout.trim().split("\n").at(-1) ?? "";

package/src/cli/commands/__tests__/conversations-slack.test.ts

@@ -98,6 +98,7 @@ mock.module("../../../ipc/gateway-client.js", () => ({
 }));
 
 mock.module("../../../messaging/providers/slack/send.js", () => ({
+  updateSlackMessage: async () => ({ ok: true, ts: "ts" }),
   sendSlackReply: async (
     chatId: string,
     text: string,