@vellumai/assistant 0.11.4 → 0.11.5-staging.1

package/src/__tests__/anthropic-provider.test.ts

@@ -160,6 +160,13 @@ function cachedPrefixBlock(text: string): ContentBlock {
   } as unknown as ContentBlock;
 }
 
+/**
+ * A 1x1 PNG. The send boundary validates image bytes before serialization, so
+ * an image fixture has to carry a real signature to reach the wire.
+ */
+const PNG_B64 =
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFAAH/q842iQAAAABJRU5ErkJggg==";
+
 const sampleTools: ToolDefinition[] = [
   {
     name: "file_read",
@@ -2754,7 +2761,7 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
                 source: {
                   type: "base64",
                   media_type: "image/png",
-                  data: "iVBOR",
+                  data: PNG_B64,
                 },
               },
               { type: "text", text: "extra error detail" },
@@ -2806,7 +2813,7 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
                 source: {
                   type: "base64",
                   media_type: "image/png",
-                  data: "iVBOR",
+                  data: PNG_B64,
                 },
               },
             ],
@@ -2853,7 +2860,7 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
                 source: {
                   type: "base64",
                   media_type: "image/png",
-                  data: "iVBOR",
+                  data: PNG_B64,
                 },
               },
             ],

package/src/__tests__/approval-interception-trust-gates.test.ts

@@ -188,6 +188,46 @@ describe("approval interception trust-class gates", () => {
     );
   });
 
+  test("the principal-gate rejection stays visible only to the actor on Slack", async () => {
+    // A rejection that loses its audience is posted to the whole channel,
+    // telling everyone present that someone failed a guardian check. The
+    // audience is one object rather than a flag beside an id so it cannot be
+    // half-dropped, and this pins that it is actually sent.
+    _anchorPrincipalId = "the-real-guardian-principal";
+    registerPendingInteraction(
+      "req-guardian-mismatch-slack",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-mismatch-slack:approve_once",
+      content: "",
+      conversationExternalId: "C0SLACKROOM",
+      sourceChannel: "slack",
+      actorExternalId: "U0STALEGUARDIAN",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "slack",
+        trustClass: "guardian",
+        requesterExternalUserId: "U0STALEGUARDIAN",
+        guardianExternalUserId: "U0STALEGUARDIAN",
+        guardianPrincipalId: "some-other-principal",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(deliverSpy).toHaveBeenCalledWith(
+      "https://gateway.test/deliver",
+      expect.objectContaining({
+        text: "Sorry, I couldn't process that. Please try again.",
+        audience: { kind: "oneReader", userId: "U0STALEGUARDIAN" },
+      }),
+    );
+  });
+
   test("guardian without a resolved acting principal is rejected before any decision", async () => {
     // Address-only guardian classification (e.g. a binding row with a null
     // principal) must not authorize decisions.

package/src/__tests__/background-workers-disk-pressure.test.ts

@@ -99,7 +99,7 @@ mock.module("../persistence/conversation-crud.js", () => ({
   parseConversation: (row: unknown) => row,
   provenanceFromTrustContext: () => ({ source: "user" }),
   relinkAttachments: mock(() => {}),
-  selectSlackMetaCandidateMetadata: () => null,
+  selectProviderMetaCandidateMetadata: () => null,
   setConversationOriginChannelIfUnset: mock(() => {}),
   setConversationOriginInterfaceIfUnset: mock(() => {}),
   setConversationInferenceProfile: mock(() => {}),

package/src/__tests__/channel-approval-routes.test.ts

@@ -1614,6 +1614,10 @@ describe("background channel processing approval prompts", () => {
       | { requestId?: string }
       | undefined;
     expect(approvalMeta?.requestId).toBe("req-bg-1");
+    // Telegram's chat is already one-to-one, so the prompt stays where the
+    // turn is. Slack, where it does not, is covered in
+    // guardian-prompt-notice-privacy.test.ts.
+    expect(deliverPromptSpy.mock.calls[0]?.[1]).toBe("chat-123");
 
     deliverPromptSpy.mockRestore();
   });

package/src/__tests__/channel-inbound-disk-pressure.test.ts

@@ -250,7 +250,7 @@ describe("channel inbound disk pressure gate", () => {
 
     expect(body).toMatchObject({
       accepted: true,
-      duplicate: false,
+      reaction: "dropped_disk_pressure",
       diskPressure: "blocked",
       reason: "trusted-contact",
     });
@@ -268,9 +268,9 @@ describe("channel inbound disk pressure gate", () => {
         eq(channelInboundEvents.externalMessageId, "slack-reaction-blocked"),
       )
       .get();
-    expect(event?.processingStatus).toBe("processed");
-    expect(event?.messageId).toBeNull();
-    expect(event?.rawPayload).toBeNull();
+    // A blocked reaction writes nothing at all: it is dropped before the
+    // reacted message is resolved, so no event row is opened either.
+    expect(event).toBeUndefined();
     expect(db.select().from(messages).all()).toHaveLength(0);
   });
 
@@ -414,8 +414,7 @@ describe("channel inbound disk pressure gate", () => {
           chatId: "slack-channel-1",
           text: expectedRemoteBlockReply,
           assistantId: "self",
-          ephemeral: true,
-          user: "slack-user-1",
+          audience: { kind: "oneReader", userId: "slack-user-1" },
         },
       ],
     ]);

package/src/__tests__/channel-reply-delivery.test.ts

@@ -58,6 +58,19 @@ const renderedHistoryContentQueue: RenderedHistoryStub[] = [];
 
 let deliveryFailAtIndex = -1;
 
+const editCalls: { callbackUrl: string; target: Record<string, unknown> }[] =
+  [];
+
+mock.module("../messaging/providers/index.js", () => ({
+  editChannelMessage: async (
+    callbackUrl: string,
+    target: Record<string, unknown>,
+  ) => {
+    editCalls.push({ callbackUrl, target });
+    return { ok: true };
+  },
+}));
+
 mock.module("../runtime/gateway-client.js", () => ({
   deliverChannelReply: async (
     callbackUrl: string,
@@ -782,31 +795,32 @@ describe("channel-reply-delivery", () => {
       chatId: "chat-live",
       attachments,
       assistantId: undefined,
-      ephemeral: undefined,
-      user: undefined,
-      messageTs: "1700000000.000055",
+      audience: undefined,
     });
+    // Attachments post as new messages, so nothing is edited on this path.
+    expect(editCalls).toHaveLength(0);
     expect(seenTs).toEqual(["1700000000.000055"]);
   });
 
-  it("passes ephemeral and user through to each delivery call", async () => {
+  it("carries the audience through to every delivery call", async () => {
+    const audience = { kind: "oneReader", userId: "U456" } as const;
     await deliverRenderedReplyViaCallback({
       callbackUrl: "http://gateway/deliver/slack",
       chatId: "C123",
       textSegments: ["Part 1.", "Part 2."],
       interSegmentDelayMs: 0,
-      ephemeral: true,
-      user: "U456",
+      audience,
     });
 
     expect(deliveryCalls).toHaveLength(2);
-    expect(deliveryCalls[0].payload.ephemeral).toBe(true);
-    expect(deliveryCalls[0].payload.user).toBe("U456");
-    expect(deliveryCalls[1].payload.ephemeral).toBe(true);
-    expect(deliveryCalls[1].payload.user).toBe("U456");
+    // Every segment, not just the first: a reply restricted to one reader
+    // that loses the restriction partway becomes a public one.
+    for (const call of deliveryCalls) {
+      expect(call.payload.audience).toEqual(audience);
+    }
   });
 
-  it("does not include ephemeral fields when not set", async () => {
+  it("leaves the audience unset when the reply is for the room", async () => {
     await deliverRenderedReplyViaCallback({
       callbackUrl: "http://gateway/deliver/slack",
       chatId: "C123",
@@ -815,8 +829,7 @@ describe("channel-reply-delivery", () => {
     });
 
     expect(deliveryCalls).toHaveLength(1);
-    expect(deliveryCalls[0].payload.ephemeral).toBeUndefined();
-    expect(deliveryCalls[0].payload.user).toBeUndefined();
+    expect(deliveryCalls[0].payload.audience).toBeUndefined();
   });
 
   it("suppresses delivery when the only text segment is <no_response/>", async () => {

package/src/__tests__/checker.test.ts

@@ -39,6 +39,7 @@ mock.module("../util/logger.js", () => ({
 
 import {
   installIpcMock,
+  lastIpcParams,
   mockIpcResponse,
 } from "./helpers/gateway-classify-mock.js";
 installIpcMock();
@@ -53,7 +54,8 @@ function mockRisk(
   mockIpcResponse("classify_risk", {
     risk,
     reason: "test fixture",
-    matchType: "shell",
+    matchType: "registry",
+    scopeOptions: [],
     ...extras,
   });
 }
@@ -82,8 +84,6 @@ import * as envRegistry from "../config/env-registry.js";
 import {
   check,
   classifyRisk,
-  clearRiskCache,
-  generateAllowlistOptions,
   generateScopeOptions,
   SCOPE_AWARE_TOOLS,
 } from "../permissions/checker.js";
@@ -180,8 +180,6 @@ describe("Permission Checker", () => {
     mockIpcResponse("get_global_thresholds", DEFAULT_GATEWAY_THRESHOLDS);
     // Clear the gateway threshold cache so each test gets a fresh threshold read
     _clearGlobalCacheForTesting();
-    // Reset trust-store state and risk classification cache between tests
-    clearRiskCache();
     // Reset guardian persona mock so each test opts in explicitly
     mockGuardianPersonaPath = null;
     loggerWarnCalls.length = 0;
@@ -447,268 +445,6 @@ describe("Permission Checker", () => {
     });
   });
 
-  // ── generateAllowlistOptions ───────────────────────────────────
-
-  describe("generateAllowlistOptions", () => {
-    test("file_write: generates prefixed file, ancestor directory wildcards, and tool wildcard", async () => {
-      const options = await generateAllowlistOptions("file_write", {
-        path: "/home/user/project/file.ts",
-      });
-      expect(options).toHaveLength(5);
-      // Patterns are prefixed with tool name to match check()'s "tool:path" format
-      expect(options[0].pattern).toBe("file_write:/home/user/project/file.ts");
-      expect(options[1].pattern).toBe("file_write:/home/user/project/**");
-      expect(options[2].pattern).toBe("file_write:/home/user/**");
-      expect(options[3].pattern).toBe("file_write:/home/**");
-      expect(options[4].pattern).toBe("file_write:*");
-      // Labels stay user-friendly
-      expect(options[0].label).toBe("/home/user/project/file.ts");
-      expect(options[1].label).toBe("/home/user/project/**");
-    });
-
-    test("file_read: generates prefixed file, directory, and tool wildcard", async () => {
-      const options = await generateAllowlistOptions("file_read", {
-        path: "/tmp/data.json",
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].pattern).toBe("file_read:/tmp/data.json");
-      expect(options[1].pattern).toBe("file_read:/tmp/**");
-      expect(options[2].pattern).toBe("file_read:*");
-    });
-
-    test("host_file_read: generates prefixed file, directory, and tool wildcard", async () => {
-      const options = await generateAllowlistOptions("host_file_read", {
-        path: "/etc/hosts",
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].pattern).toBe("host_file_read:/etc/hosts");
-      expect(options[1].pattern).toBe("host_file_read:/etc/**");
-      expect(options[2].pattern).toBe("host_file_read:*");
-    });
-
-    test("host_file_write with file_path key", async () => {
-      const options = await generateAllowlistOptions("host_file_write", {
-        file_path: "/tmp/out.txt",
-      });
-      expect(options[0].pattern).toBe("host_file_write:/tmp/out.txt");
-      expect(options[1].pattern).toBe("host_file_write:/tmp/**");
-      expect(options[2].pattern).toBe("host_file_write:*");
-    });
-
-    test("file_write with file_path key", async () => {
-      const options = await generateAllowlistOptions("file_write", {
-        file_path: "/tmp/out.txt",
-      });
-      expect(options[0].pattern).toBe("file_write:/tmp/out.txt");
-    });
-
-    test("unknown tool returns wildcard", async () => {
-      const options = await generateAllowlistOptions("other_tool", {
-        foo: "bar",
-      });
-      expect(options).toHaveLength(1);
-      expect(options[0].pattern).toBe("*");
-    });
-
-    test("web_fetch: generates exact url, origin wildcard, and tool wildcard", async () => {
-      const options = await generateAllowlistOptions("web_fetch", {
-        url: "https://example.com/docs/page",
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].pattern).toBe(
-        "web_fetch:https://example.com/docs/page",
-      );
-      expect(options[1].pattern).toBe("web_fetch:https://example.com/*");
-      expect(options[2].pattern).toBe("**");
-    });
-
-    test("web_fetch: strips fragments when generating allowlist options", async () => {
-      const options = await generateAllowlistOptions("web_fetch", {
-        url: "https://example.com/docs/page#section-1",
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].pattern).toBe(
-        "web_fetch:https://example.com/docs/page",
-      );
-      expect(options[1].pattern).toBe("web_fetch:https://example.com/*");
-      expect(options[2].pattern).toBe("**");
-    });
-
-    test("web_fetch: strips trailing-dot hostnames when generating allowlist options", async () => {
-      const options = await generateAllowlistOptions("web_fetch", {
-        url: "https://example.com./docs/page",
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].pattern).toBe(
-        "web_fetch:https://example.com/docs/page",
-      );
-      expect(options[1].pattern).toBe("web_fetch:https://example.com/*");
-      expect(options[2].pattern).toBe("**");
-    });
-
-    test("web_fetch: strips userinfo when generating allowlist options", async () => {
-      const username = "demo";
-      const credential = ["c", "r", "e", "d", "1", "2", "3"].join("");
-      const credentialedUrl = new URL("https://example.com/docs/page");
-      credentialedUrl.username = username;
-      credentialedUrl.password = credential;
-      const options = await generateAllowlistOptions("web_fetch", {
-        url: credentialedUrl.href,
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].pattern).toBe(
-        "web_fetch:https://example.com/docs/page",
-      );
-      expect(options[1].pattern).toBe("web_fetch:https://example.com/*");
-      expect(options[2].pattern).toBe("**");
-      expect(options[0].pattern).not.toContain("demo:cred123@");
-    });
-
-    test("web_fetch: normalizes scheme-less host:port for allowlist options", async () => {
-      const options = await generateAllowlistOptions("web_fetch", {
-        url: "example.com:8443/docs/page",
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].pattern).toBe(
-        "web_fetch:https://example.com:8443/docs/page",
-      );
-      expect(options[1].pattern).toBe("web_fetch:https://example.com:8443/*");
-      expect(options[2].pattern).toBe("**");
-    });
-
-    test("web_fetch: does not coerce path-only urls to https hostnames in allowlist options", async () => {
-      const options = await generateAllowlistOptions("web_fetch", {
-        url: "/docs/getting-started",
-      });
-      expect(options).toHaveLength(2);
-      expect(options[0].pattern).toBe("web_fetch:/docs/getting-started");
-      expect(options[1].pattern).toBe("**");
-    });
-
-    test("scaffold_managed_skill: generates per-skill and wildcard options", async () => {
-      const options = await generateAllowlistOptions("scaffold_managed_skill", {
-        skill_id: "my-tool",
-      });
-      expect(options).toHaveLength(2);
-      expect(options[0].label).toBe("my-tool");
-      expect(options[0].pattern).toBe("scaffold_managed_skill:my-tool");
-      expect(options[0].description).toBe("This skill only");
-      expect(options[1].label).toBe("scaffold_managed_skill:*");
-      expect(options[1].pattern).toBe("scaffold_managed_skill:*");
-      expect(options[1].description).toBe("All managed skill scaffolds");
-    });
-
-    test("delete_managed_skill: generates per-skill and wildcard options", async () => {
-      const options = await generateAllowlistOptions("delete_managed_skill", {
-        skill_id: "doomed",
-      });
-      expect(options).toHaveLength(2);
-      expect(options[0].pattern).toBe("delete_managed_skill:doomed");
-      expect(options[1].pattern).toBe("delete_managed_skill:*");
-      expect(options[1].description).toBe("All managed skill deletes");
-    });
-
-    test("scaffold_managed_skill with empty skill_id: only wildcard option", async () => {
-      const options = await generateAllowlistOptions("scaffold_managed_skill", {
-        skill_id: "",
-      });
-      expect(options).toHaveLength(1);
-      expect(options[0].pattern).toBe("scaffold_managed_skill:*");
-    });
-
-    test("web_fetch: escapes minimatch metacharacters in generated exact and origin patterns", async () => {
-      const options = await generateAllowlistOptions("web_fetch", {
-        url: "https://[2001:db8::1]/search?q=test",
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].label).toBe("https://[2001:db8::1]/search?q=test");
-      expect(options[0].pattern).toBe(
-        "web_fetch:https://\\[2001:db8::1\\]/search\\?q=test",
-      );
-      expect(options[1].pattern).toBe("web_fetch:https://\\[2001:db8::1\\]/*");
-      expect(options[2].pattern).toBe("**");
-    });
-
-    // ── network_request allowlist options ─────────────────────────
-
-    test("network_request: generates exact url, origin wildcard, and tool wildcard", async () => {
-      const options = await generateAllowlistOptions("network_request", {
-        url: "https://api.example.com/v1/data",
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].pattern).toBe(
-        "network_request:https://api.example.com/v1/data",
-      );
-      expect(options[1].pattern).toBe(
-        "network_request:https://api.example.com/*",
-      );
-      expect(options[2].pattern).toBe("**");
-      expect(options[2].label).toBe("network_request:*");
-      expect(options[2].description).toBe("All network requests");
-    });
-
-    test("network_request: origin wildcard uses friendly hostname", async () => {
-      const options = await generateAllowlistOptions("network_request", {
-        url: "https://www.example.com/path",
-      });
-      expect(options[1].description).toBe("Any page on example.com");
-    });
-
-    test("network_request: normalizes scheme-less host:port input", async () => {
-      const options = await generateAllowlistOptions("network_request", {
-        url: "api.example.com:8443/v1/data",
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].pattern).toBe(
-        "network_request:https://api.example.com:8443/v1/data",
-      );
-      expect(options[1].pattern).toBe(
-        "network_request:https://api.example.com:8443/*",
-      );
-      expect(options[2].pattern).toBe("**");
-    });
-
-    test("network_request: strips fragments and userinfo", async () => {
-      const username = "demo";
-      const credential = ["c", "r", "e", "d", "1", "2", "3"].join("");
-      const credentialedUrl = new URL(
-        "https://api.example.com/v1/data#section",
-      );
-      credentialedUrl.username = username;
-      credentialedUrl.password = credential;
-      const options = await generateAllowlistOptions("network_request", {
-        url: credentialedUrl.href,
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].pattern).toBe(
-        "network_request:https://api.example.com/v1/data",
-      );
-      expect(options[0].pattern).not.toContain("demo:cred123@");
-      expect(options[0].pattern).not.toContain("#section");
-    });
-
-    test("network_request: escapes minimatch metacharacters", async () => {
-      const options = await generateAllowlistOptions("network_request", {
-        url: "https://[2001:db8::1]/api?key=val",
-      });
-      expect(options).toHaveLength(3);
-      expect(options[0].pattern).toBe(
-        "network_request:https://\\[2001:db8::1\\]/api\\?key=val",
-      );
-      expect(options[1].pattern).toBe(
-        "network_request:https://\\[2001:db8::1\\]/*",
-      );
-    });
-
-    test("network_request: empty url produces only tool wildcard", async () => {
-      const options = await generateAllowlistOptions("network_request", {
-        url: "",
-      });
-      expect(options).toHaveLength(1);
-      expect(options[0].pattern).toBe("**");
-    });
-  });
-
   // ── generateScopeOptions ───────────────────────────────────────
 
   describe("generateScopeOptions", () => {
@@ -1287,65 +1023,39 @@ describe("Permission Checker", () => {
   // pattern (skillId@hash) and an any-version pattern (bare skillId).
   // Input-supplied version_hash is always ignored to prevent spoofing.
 
-  describe("hash-aware skill_load permission candidates (PR 33)", () => {
+  describe("skill metadata sent to the gateway", () => {
     function ensureSkillsDir(): void {
       mkdirSync(join(checkerTestDir, "skills"), { recursive: true });
     }
 
-    test("allowlist options only include version-specific option when hash is available", async () => {
-      ensureSkillsDir();
-      writeSkill("test-opts-skill", "Test Options Skill");
-
-      const options = await generateAllowlistOptions("skill_load", {
-        skill: "test-opts-skill",
-      });
-
-      // Should have only the version-specific option
-      expect(options).toHaveLength(1);
-      expect(options[0].pattern).toMatch(/^skill_load:test-opts-skill@v1:/);
-      expect(options[0].description).toBe("This exact version");
-    });
-
-    test("allowlist options ignore input version_hash and use disk-computed hash (regression)", async () => {
+    test("the version hash comes from disk, never from the model's input", async () => {
+      // The gateway builds the version-pinned trust-rule option from the hash
+      // the daemon sends; taking it from the invocation would let a caller pin
+      // a rule to a version that was never on disk.
       ensureSkillsDir();
       writeSkill("test-opts-explicit", "Test Opts Explicit");
 
-      // Even when a version_hash is supplied in the input, allowlist
-      // options must use the disk-computed hash, not the input value.
-      const options = await generateAllowlistOptions("skill_load", {
+      await classifyRisk("skill_load", {
         skill: "test-opts-explicit",
         version_hash: "v1:customhash123",
       });
 
-      expect(options).toHaveLength(1);
-      // Should be the disk-computed hash, NOT the input hash
-      expect(options[0].pattern).toMatch(/^skill_load:test-opts-explicit@v1:/);
-      expect(options[0].pattern).not.toBe(
-        "skill_load:test-opts-explicit@v1:customhash123",
-      );
-      expect(options[0].description).toBe("This exact version");
+      const metadata = lastIpcParams("classify_risk")?.skillMetadata as
+        | { skillId: string; versionHash: string }
+        | undefined;
+      expect(metadata?.skillId).toBe("test-opts-explicit");
+      expect(metadata?.versionHash).toMatch(/^v1:/);
+      expect(metadata?.versionHash).not.toBe("v1:customhash123");
     });
 
-    test("allowlist options for unresolvable skill fall back to raw selector", async () => {
+    test("an unresolvable selector is sent with no metadata", async () => {
       ensureSkillsDir();
 
-      const options = await generateAllowlistOptions("skill_load", {
-        skill: "no-such-skill",
-      });
-
-      // Should have only the raw selector
-      expect(options).toHaveLength(1);
-      expect(options[0].pattern).toBe("skill_load:no-such-skill");
-      expect(options[0].description).toBe("This skill");
-    });
-
-    test("allowlist options for empty skill selector only has wildcard", async () => {
-      const options = await generateAllowlistOptions("skill_load", {
-        skill: "",
-      });
+      await classifyRisk("skill_load", { skill: "no-such-skill" });
 
-      expect(options).toHaveLength(1);
-      expect(options[0].pattern).toBe("skill_load:*");
+      const params = lastIpcParams("classify_risk");
+      expect(params?.skill).toBe("no-such-skill");
+      expect(params?.skillMetadata).toBeUndefined();
     });
   });
 
@@ -1514,7 +1224,6 @@ describe("bash network_mode=proxied — risk capped at medium", () => {
     mockRisk("low");
     mockIpcResponse("get_global_thresholds", DEFAULT_GATEWAY_THRESHOLDS);
     _clearGlobalCacheForTesting();
-    clearRiskCache();
   });
 
   test("proxied bash follows risk-based policy (medium risk → prompt outside container)", async () => {
@@ -1562,7 +1271,6 @@ describe("credentialed proxied bash — high risk escalation", () => {
     mockRisk("low");
     mockIpcResponse("get_global_thresholds", DEFAULT_GATEWAY_THRESHOLDS);
     _clearGlobalCacheForTesting();
-    clearRiskCache();
   });
 
   test("proxied bash with credential_ids sends credentialRefCount in IPC params", async () => {
@@ -1652,7 +1360,6 @@ describe("workspace mode — auto-allow workspace-scoped operations", () => {
     mockRisk("low");
     mockIpcResponse("get_global_thresholds", DEFAULT_GATEWAY_THRESHOLDS);
     _clearGlobalCacheForTesting();
-    clearRiskCache();
     try {
       rmSync(join(checkerTestDir, "protected", "trust.json"));
     } catch {
@@ -1796,7 +1503,6 @@ describe("integration regressions (PR 11)", () => {
     mockRisk("low");
     mockIpcResponse("get_global_thresholds", DEFAULT_GATEWAY_THRESHOLDS);
     _clearGlobalCacheForTesting();
-    clearRiskCache();
     // Delete the trust file to prevent stale default rules from prior tests
     try {
       rmSync(join(checkerTestDir, "protected", "trust.json"));

package/src/__tests__/cli-memory-v2-reembed-skills.test.ts

@@ -45,6 +45,10 @@ mock.module("../plugins/defaults/memory/substrate/skill-store.js", () => ({
   seedV2SkillEntries: async () => {
     seedCallCount += 1;
   },
+  // The validate route builds the page index, which reads the seeded
+  // skill catalog; an empty catalog keeps that walk inert here.
+  listSkillEntries: () => [],
+  SKILL_SLUG_PREFIX: "skills/",
 }));
 
 // ---------------------------------------------------------------------------
@@ -254,7 +258,7 @@ describe("all memory v2 routes — MEMORY_V2_DISABLED gate", () => {
     const result = (await route!.handler({ body: {} })) as {
       pageCount: number;
       edgeCount: number;
-      missingEdgeEndpoints: unknown[];
+      danglingLinks: unknown[];
       oversizedPages: unknown[];
       parseFailures: unknown[];
     };
@@ -263,7 +267,7 @@ describe("all memory v2 routes — MEMORY_V2_DISABLED gate", () => {
     // returned at all (no MEMORY_V2_DISABLED throw).
     expect(result.pageCount).toBe(0);
     expect(result.edgeCount).toBe(0);
-    expect(result.missingEdgeEndpoints).toEqual([]);
+    expect(result.danglingLinks).toEqual([]);
     expect(result.oversizedPages).toEqual([]);
     expect(result.parseFailures).toEqual([]);
   });