@vellumai/assistant 0.11.4 → 0.11.5-staging.1

package/src/__tests__/media-resolve-image-validation.test.ts

@@ -0,0 +1,310 @@
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import {
+  unsendableImageCardText,
+  unsendableImageFilenames,
+} from "../daemon/unsendable-image-notice.js";
+import { createInlineAttachment } from "../persistence/attachments-store.js";
+import {
+  addMessage,
+  createConversation,
+} from "../persistence/conversation-crud.js";
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+import {
+  isUnsendableImageSource,
+  resolveMediaReferences,
+  UNSENDABLE_IMAGE_FORMAT_NOTE,
+} from "../providers/media-resolve.js";
+import type { ContentBlock, Message } from "../providers/types.js";
+
+await initializeDb();
+
+function resetTables() {
+  const db = getDb();
+  db.run("DELETE FROM message_attachments");
+  db.run("DELETE FROM attachments");
+  db.run("DELETE FROM messages");
+  db.run("DELETE FROM conversations");
+}
+
+/** A 1x1 PNG: a real signature plus enough body to be a decodable image. */
+const PNG_B64 =
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFAAH/q842iQAAAABJRU5ErkJggg==";
+
+/**
+ * A HEIC head (ISO BMFF `ftyp` + the `heic` brand) under a `.png` name, which
+ * is what a photo renamed by hand or exported by iOS arrives as.
+ */
+const HEIC_B64 = Buffer.from([
+  0x00, 0x00, 0x00, 0x18, 0x66, 0x74, 0x79, 0x70, 0x68, 0x65, 0x69, 0x63, 0x00,
+  0x00, 0x00, 0x00,
+]).toString("base64");
+
+/** A PNG whose signature bytes are damaged, as a partial upload leaves it. */
+const CORRUPT_PNG_B64 = Buffer.from([
+  0x89, 0x50, 0x4e, 0x00, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d,
+]).toString("base64");
+
+function userMessage(content: ContentBlock[]): Message {
+  return { role: "user", content };
+}
+
+function inlineImage(mediaType: string, data: string): ContentBlock {
+  return {
+    type: "image",
+    source: { type: "base64", media_type: mediaType, data },
+  };
+}
+
+async function storedImageRef(
+  filename: string,
+  mimeType: string,
+  dataBase64: string,
+): Promise<ContentBlock> {
+  const conv = createConversation();
+  const stored = await createInlineAttachment(
+    conv.id,
+    conv.createdAt,
+    filename,
+    mimeType,
+    dataBase64,
+  );
+  return {
+    type: "image",
+    source: {
+      type: "workspace_ref",
+      media_type: mimeType,
+      attachmentId: stored.id,
+      sizeBytes: stored.sizeBytes,
+      filename,
+    },
+  };
+}
+
+describe("resolveMediaReferences image validation", () => {
+  beforeEach(resetTables);
+
+  test("sends a valid inline image untouched", async () => {
+    // GIVEN a message carrying an inline PNG whose bytes match its declaration
+    const message = userMessage([inlineImage("image/png", PNG_B64)]);
+
+    // WHEN the send boundary resolves it
+    const [resolved] = await resolveMediaReferences([message]);
+
+    // THEN the block is unchanged, and the message is the same object (no
+    // allocation or disk read on the clean live-turn fast path)
+    expect(resolved).toBe(message);
+  });
+
+  test("drops the unreadable image from a batch and keeps the valid ones", async () => {
+    // GIVEN a batch of a valid PNG, a HEIC photo declared as a PNG, and a
+    // truncated PNG: the shape of the eight-image upload that lost a whole turn
+    const message = userMessage([
+      { type: "text", text: "what is in these?" },
+      inlineImage("image/png", PNG_B64),
+      inlineImage("image/png", HEIC_B64),
+      inlineImage("image/png", CORRUPT_PNG_B64),
+    ]);
+
+    // WHEN the send boundary resolves them
+    const [resolved] = await resolveMediaReferences([message]);
+
+    // THEN the valid image still goes to the model
+    expect(resolved.content[1]).toEqual(inlineImage("image/png", PNG_B64));
+
+    // AND each unreadable image is replaced by a note instead of failing the
+    // whole request
+    expect(resolved.content[2]).toEqual({
+      type: "text",
+      text: UNSENDABLE_IMAGE_FORMAT_NOTE,
+    });
+    expect(resolved.content[3]).toEqual({
+      type: "text",
+      text: UNSENDABLE_IMAGE_FORMAT_NOTE,
+    });
+  });
+
+  test("keeps a HEIC photo for a provider that decodes HEIF", async () => {
+    /**
+     * Gemini reads image/heic and image/heif directly, so an untranscoded HEIC
+     * photo must reach it as an image rather than as an omission note.
+     */
+    // GIVEN a HEIC photo declared as a PNG, as an untranscoded upload arrives
+    const message = userMessage([inlineImage("image/png", HEIC_B64)]);
+
+    // WHEN a provider that accepts HEIF resolves it
+    const [resolved] = await resolveMediaReferences([message], {
+      acceptsHeif: true,
+    });
+
+    // THEN the image survives, declared as the HEIF type its brand names
+    expect(resolved.content[0]).toEqual(inlineImage("image/heic", HEIC_B64));
+  });
+
+  test("relabels an inline image whose declared type is not its actual type", async () => {
+    // GIVEN PNG bytes declared as JPEG, which every provider rejects outright
+    const message = userMessage([inlineImage("image/jpeg", PNG_B64)]);
+
+    // WHEN the send boundary resolves it
+    const [resolved] = await resolveMediaReferences([message]);
+
+    // THEN the declaration is corrected to what the bytes are, payload intact
+    expect(resolved.content[0]).toEqual(inlineImage("image/png", PNG_B64));
+  });
+
+  test("drops a stored image whose bytes are not a readable format", async () => {
+    // GIVEN a persisted attachment holding HEIC bytes under a .png name,
+    // referenced by a reloaded message
+    const block = await storedImageRef("photo.png", "image/png", HEIC_B64);
+
+    // WHEN the send boundary resolves the reference
+    const [resolved] = await resolveMediaReferences([userMessage([block])]);
+
+    // THEN it is replaced by the note rather than hydrated and sent
+    expect(resolved.content[0]).toEqual({
+      type: "text",
+      text: UNSENDABLE_IMAGE_FORMAT_NOTE,
+    });
+  });
+
+  test("keeps the unavailable-attachment note for a reference with no bytes", async () => {
+    // GIVEN a reference to an attachment row that does not exist
+    const block: ContentBlock = {
+      type: "image",
+      source: {
+        type: "workspace_ref",
+        media_type: "image/png",
+        attachmentId: "missing-attachment",
+        sizeBytes: 1024,
+        filename: "gone.png",
+      },
+    };
+
+    // WHEN the send boundary resolves it
+    const [resolved] = await resolveMediaReferences([userMessage([block])]);
+
+    // THEN an unreadable payload is reported as unavailable, not as a bad
+    // format: the file may simply have been collected
+    expect(resolved.content[0]).toEqual({
+      type: "text",
+      text: "[Attachment unavailable: image could not be loaded]",
+    });
+  });
+
+  test("validates images nested in a tool result", async () => {
+    // GIVEN a tool result carrying one readable and one corrupt image
+    const message = userMessage([
+      {
+        type: "tool_result",
+        tool_use_id: "tool-1",
+        content: "two screenshots",
+        contentBlocks: [
+          inlineImage("image/png", PNG_B64),
+          inlineImage("image/png", CORRUPT_PNG_B64),
+        ],
+      },
+    ]);
+
+    // WHEN the send boundary resolves it
+    const [resolved] = await resolveMediaReferences([message]);
+
+    // THEN the tool_use/tool_result pairing survives with the bad image noted
+    const toolResult = resolved.content[0];
+    if (toolResult.type !== "tool_result") {
+      throw new Error(`expected tool_result, got ${toolResult.type}`);
+    }
+    expect(toolResult.contentBlocks).toEqual([
+      inlineImage("image/png", PNG_B64),
+      { type: "text", text: UNSENDABLE_IMAGE_FORMAT_NOTE },
+    ]);
+  });
+});
+
+describe("isUnsendableImageSource", () => {
+  beforeEach(resetTables);
+
+  test("reports a stored attachment the send boundary will drop", async () => {
+    // GIVEN one attachment holding a real PNG and one holding HEIC bytes
+    const good = await storedImageRef("good.png", "image/png", PNG_B64);
+    const bad = await storedImageRef("bad.png", "image/png", HEIC_B64);
+    if (good.type !== "image" || bad.type !== "image") {
+      throw new Error("expected image blocks");
+    }
+
+    // WHEN each source is checked
+    // THEN only the unreadable one is reported, matching what the boundary does
+    expect(isUnsendableImageSource(good.source)).toBe(false);
+    expect(isUnsendableImageSource(bad.source)).toBe(true);
+  });
+
+  test("does not report a reference whose attachment is gone", () => {
+    // GIVEN a reference with no row behind it
+    // WHEN it is checked
+    // THEN it is not called unsendable: a missing payload is a separate
+    // failure, and naming it in the drop card would misinform the user
+    expect(
+      isUnsendableImageSource({
+        type: "workspace_ref",
+        media_type: "image/png",
+        attachmentId: "missing-attachment",
+        sizeBytes: 10,
+        filename: "gone.png",
+      }),
+    ).toBe(false);
+  });
+});
+
+describe("unsendable-image notice", () => {
+  beforeEach(resetTables);
+
+  test("names only the attachments the model cannot see", async () => {
+    // GIVEN a message whose attachments are one valid PNG and one HEIC-as-PNG
+    const msgConv = createConversation();
+    await addMessage(msgConv.id, "user", "look at these");
+    const good = await storedImageRef("holiday.png", "image/png", PNG_B64);
+    const bad = await storedImageRef("beach.png", "image/png", HEIC_B64);
+    if (good.type !== "image" || bad.type !== "image") {
+      throw new Error("expected image blocks");
+    }
+
+    // WHEN the notice decides what to name
+    const filenames = unsendableImageFilenames([
+      { filename: "holiday.png", source: good.source },
+      { filename: "beach.png", source: bad.source },
+    ]);
+
+    // THEN only the dropped file is named, so the user knows which to convert
+    expect(filenames).toEqual(["beach.png"]);
+
+    // AND the card copy names it and says what to do about it
+    expect(unsendableImageCardText(filenames)).toBe(
+      "beach.png was not sent to the model: the file is not a PNG, JPEG, GIF, or WebP image. Convert it and attach it again to include it.",
+    );
+  });
+
+  test("posts no notice when every attachment is readable", async () => {
+    // GIVEN attachments that are all valid images
+    const good = await storedImageRef("one.png", "image/png", PNG_B64);
+    if (good.type !== "image") {
+      throw new Error("expected an image block");
+    }
+
+    // WHEN the notice decides what to name
+    // THEN there is nothing to say, so no card is written
+    expect(
+      unsendableImageFilenames([{ filename: "one.png", source: good.source }]),
+    ).toEqual([]);
+  });
+
+  test("names every dropped file when a batch has several", () => {
+    // GIVEN two inline attachments whose bytes are unreadable
+    // WHEN the card copy is built for them
+    const text = unsendableImageCardText(["a.png", "b.png"]);
+
+    // THEN both are named in plural copy
+    expect(text).toBe(
+      "a.png, b.png were not sent to the model: the files are not PNG, JPEG, GIF, or WebP images. Convert them and attach them again to include them.",
+    );
+  });
+});

package/src/__tests__/mtime-cache.test.ts

@@ -38,6 +38,7 @@ import {
   reconcilePluginSourcesNow,
   resetPluginCacheForTests,
 } from "../plugins/mtime-cache.js";
+import { resetPluginRegistryForTests } from "../plugins/registry.js";
 import { getSourceVersionsPath } from "../plugins/source-versions.js";
 import {
   __resetRegistryForTesting,
@@ -157,6 +158,7 @@ beforeEach(() => {
   // The registry pulls plugin tools via loadPluginTools(); clear its side
   // (tools + pulled fingerprints) so registrations never leak across tests.
   __resetRegistryForTesting();
+  resetPluginRegistryForTests();
 });
 
 afterAll(() => {

package/src/__tests__/notification-vellum-adapter.test.ts

@@ -1,4 +1,28 @@
-import { describe, expect, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ── Mocks: declared before imports that depend on them ──────────────
+
+let updateMessageContentShouldThrow = false;
+
+const updateMessageContentMock = mock(
+  (_messageId: string, _content: string) => {
+    if (updateMessageContentShouldThrow) {
+      throw new Error("DB write failed");
+    }
+  },
+);
+
+mock.module("../persistence/conversation-crud.js", () => ({
+  updateMessageContent: updateMessageContentMock,
+}));
+
+const messagesInvalidated: string[] = [];
+
+mock.module("../runtime/sync/resource-sync-events.js", () => ({
+  publishConversationMessagesChanged: (conversationId: string) => {
+    messagesInvalidated.push(conversationId);
+  },
+}));
 
 import type { AssistantEvent } from "../api/index.js";
 import { VellumAdapter } from "../notifications/adapters/macos.js";
@@ -156,3 +180,102 @@ describe("VellumAdapter remotePushDispatched pass-through", () => {
     expect(intent.remotePushDispatched).toBeUndefined();
   });
 });
+
+describe("VellumAdapter update", () => {
+  beforeEach(() => {
+    updateMessageContentMock.mockClear();
+    updateMessageContentShouldThrow = false;
+    messagesInvalidated.length = 0;
+  });
+
+  test("rewrites the persisted conversation message with the new body", async () => {
+    const { adapter } = captureBroadcast();
+
+    const result = await adapter.update!(
+      {
+        deliveryId: "delivery-1",
+        destination: "vellum",
+        messageId: "msg-1",
+        conversationId: "conv-1",
+      },
+      { title: "Daily Briefing", body: "Revised briefing text." },
+    );
+
+    expect(result.success).toBe(true);
+    expect(result.messageId).toBe("msg-1");
+    expect(updateMessageContentMock).toHaveBeenCalledTimes(1);
+    expect(updateMessageContentMock.mock.calls[0]).toEqual([
+      "msg-1",
+      "Revised briefing text.",
+    ]);
+    // A client holding the conversation open refetches on this tag alone.
+    expect(messagesInvalidated).toEqual(["conv-1"]);
+  });
+
+  test("rewrites without a conversation to invalidate", async () => {
+    // Deliveries recorded before the pairing carried a conversation have none
+    // to name, and the rewrite still stands on its own.
+    const { adapter } = captureBroadcast();
+
+    const result = await adapter.update!(
+      { deliveryId: "delivery-1", destination: "vellum", messageId: "msg-1" },
+      { body: "Revised briefing text." },
+    );
+
+    expect(result.success).toBe(true);
+    expect(updateMessageContentMock).toHaveBeenCalledTimes(1);
+    expect(messagesInvalidated).toHaveLength(0);
+  });
+
+  test("leaves the message untouched on a title-only edit", async () => {
+    // The feed rewrites its summary only when the patch carries a body, so
+    // writing the title here would put the conversation out of step with the
+    // card it is supposed to match.
+    const { adapter } = captureBroadcast();
+
+    const result = await adapter.update!(
+      { deliveryId: "delivery-1", destination: "vellum", messageId: "msg-1" },
+      { title: "Daily Briefing" },
+    );
+
+    expect(result.success).toBe(true);
+    expect(updateMessageContentMock).not.toHaveBeenCalled();
+  });
+
+  test("writes an empty body through, matching the feed summary patch", async () => {
+    const { adapter } = captureBroadcast();
+
+    await adapter.update!(
+      { deliveryId: "delivery-1", destination: "vellum", messageId: "msg-1" },
+      { title: "Daily Briefing", body: "" },
+    );
+
+    expect(updateMessageContentMock.mock.calls[0]![1]).toBe("");
+  });
+
+  test("skips deliveries that persisted no conversation message", async () => {
+    const { adapter } = captureBroadcast();
+
+    const result = await adapter.update!(
+      { deliveryId: "delivery-1", destination: "vellum", messageId: null },
+      { body: "Revised briefing text." },
+    );
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain("missing_message_id");
+    expect(updateMessageContentMock).not.toHaveBeenCalled();
+  });
+
+  test("reports failure without throwing when the write fails", async () => {
+    const { adapter } = captureBroadcast();
+    updateMessageContentShouldThrow = true;
+
+    const result = await adapter.update!(
+      { deliveryId: "delivery-1", destination: "vellum", messageId: "msg-1" },
+      { body: "Revised briefing text." },
+    );
+
+    expect(result.success).toBe(false);
+    expect(result.error).toBe("DB write failed");
+  });
+});

package/src/__tests__/openai-provider.test.ts

@@ -348,6 +348,28 @@ describe("OpenAIProvider", () => {
     }
   });
 
+  test("ollama wrapper prefers an explicit baseURL over OLLAMA_BASE_URL", () => {
+    const previousBaseUrl = process.env.OLLAMA_BASE_URL;
+    try {
+      process.env.OLLAMA_BASE_URL = "http://127.0.0.1:11434/v1";
+      const ollama = new OllamaProvider("llama3.2", {
+        baseURL: "http://192.168.1.50:11434/v1",
+      });
+      expect(ollama.name).toBe("ollama");
+      expectOpenAIConstructorOptions({
+        apiKey: "ollama",
+        baseURL: "http://192.168.1.50:11434/v1",
+        timeout: DEFAULT_SDK_TIMEOUT_MS,
+      });
+    } finally {
+      if (previousBaseUrl !== undefined) {
+        process.env.OLLAMA_BASE_URL = previousBaseUrl;
+      } else {
+        delete process.env.OLLAMA_BASE_URL;
+      }
+    }
+  });
+
   test("ollama wrapper treats empty OLLAMA_BASE_URL as unset", () => {
     const previousBaseUrl = process.env.OLLAMA_BASE_URL;
     try {

package/src/__tests__/personal-memory-auth-bypass.test.ts

@@ -14,7 +14,10 @@
  */
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
-import { isPersonalMemoryAllowed } from "../daemon/trust-context.js";
+import {
+  FALLBACK_TURN_TRUST,
+  isPersonalMemoryAllowed,
+} from "../daemon/trust-context.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
 
@@ -45,16 +48,29 @@ describe("isPersonalMemoryAllowed — no exposure to non-guardian channel actors
     expect(isPersonalMemoryAllowed(slack("unverified_contact"))).toBe(false);
   });
 
-  test("allows personal memory for the guardian and for local / internal turns", () => {
+  test("allows personal memory for the guardian and for local / native turns", () => {
     expect(isPersonalMemoryAllowed(slack("guardian"))).toBe(true);
-    // Local/native turn — no resolved actor.
+    // Local/native turn: no actor bound at all. `resolveTrustClass` elevates
+    // this to guardian under a disabled-auth posture, so identity resolution
+    // admits it rather than the memory gate carving out an exception.
     expect(isPersonalMemoryAllowed(undefined)).toBe(true);
-    // Internal vellum-channel flow.
+  });
+
+  test("blocks personal memory for the fail-closed fallback trust", () => {
+    // `{vellum, unknown}` is FALLBACK_TURN_TRUST, not an internal flow: it is
+    // what the daemon substitutes when no per-turn actor was captured. Its own
+    // contract is to bias to `unknown` "so a missing snapshot cannot
+    // accidentally grant elevated trust", and every other consumer treats it
+    // as low-trust and never guardian. Personal memory is elevated trust, so
+    // the gate has to agree with them.
+    expect(isPersonalMemoryAllowed(FALLBACK_TURN_TRUST)).toBe(false);
+    // And a resolved non-guardian is denied on the console for the same
+    // reason: a surface is not an actor.
     expect(
       isPersonalMemoryAllowed({
         sourceChannel: "vellum",
-        trustClass: "unknown",
+        trustClass: "unverified_contact",
       }),
-    ).toBe(true);
+    ).toBe(false);
   });
 });

package/src/__tests__/platform-bash-auto-approve.test.ts

@@ -44,12 +44,8 @@ mock.module("../permissions/checker.js", () => ({
     }
     return { decision: "allow", reason: "allowed" };
   },
-  generateAllowlistOptions: () => [
-    { label: "exact", description: "exact", pattern: "exact" },
-  ],
   generateScopeOptions: () =>
     scopeOptionsOverride ?? [{ label: "/tmp", scope: "/tmp" }],
-  getCachedAssessment: () => undefined,
 }));
 
 // Mock every export so downstream test files that dynamically import modules

package/src/__tests__/platform.test.ts

@@ -1,7 +1,7 @@
 import { existsSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, describe, expect, test } from "bun:test";
 
 import {
   ensureDataDir,
@@ -23,6 +23,21 @@ import {
 } from "../util/platform.js";
 
 const originalWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR;
+
+// This file characterizes path resolution itself (including the ~/.vellum
+// fallback and literal override paths) without reading or writing those
+// locations, so the live-workspace guard is deliberately bypassed.
+const originalAllowRealWorkspace =
+  process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS = "1";
+afterAll(() => {
+  if (originalAllowRealWorkspace === undefined) {
+    delete process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+  } else {
+    process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS =
+      originalAllowRealWorkspace;
+  }
+});
 const originalVellumEnvironment = process.env.VELLUM_ENVIRONMENT;
 const originalXdgConfigHome = process.env.XDG_CONFIG_HOME;
 

package/src/__tests__/plugin-api-resolve-credential.test.ts

@@ -102,21 +102,28 @@ describe("resolveCredential", () => {
   });
 
   describe("plugin scoping", () => {
-    test("allows a plugin to resolve a credential whose field matches its name", async () => {
-      seedCredential("openai", "acme", "scoped-secret");
-      const value = await runInPluginContext("acme", () =>
-        resolveCredential("openai/acme"),
+    test("allows a plugin to resolve a credential whose service matches its name", async () => {
+      seedCredential("imessage", "api_key", "comms-key");
+      const value = await runInPluginContext("imessage", () =>
+        resolveCredential("imessage/api_key"),
       );
-      expect(value).toBe("scoped-secret");
+      expect(value).toBe("comms-key");
     });
 
-    test("blocks a plugin from resolving a credential whose field differs from its name", async () => {
+    test("blocks a plugin from resolving another service", async () => {
       seedCredential("openai", "api_key", "sk-secret");
       await expect(
         runInPluginContext("acme", () => resolveCredential("openai/api_key")),
       ).rejects.toThrow(/out of scope/);
     });
 
+    test("blocks a plugin from resolving another service even when the field matches its name", async () => {
+      seedCredential("openai", "acme", "scoped-secret");
+      await expect(
+        runInPluginContext("acme", () => resolveCredential("openai/acme")),
+      ).rejects.toThrow(/out of scope/);
+    });
+
     test("does not read the secure backend when out of scope", async () => {
       seedCredential("openai", "api_key", "sk-secret");
       getSpy.mockClear();
@@ -126,15 +133,17 @@ describe("resolveCredential", () => {
       expect(getSpy).not.toHaveBeenCalled();
     });
 
-    test("scoping applies by field only, across any service", async () => {
-      seedCredential("stripe", "acme", "stripe-secret");
-      seedCredential("openai", "acme", "openai-secret");
+    test("scoping applies to every field under the plugin's service", async () => {
+      seedCredential("imessage", "api_key", "comms-key");
+      seedCredential("imessage", "photon_project_id", "proj-id");
       await expect(
-        runInPluginContext("acme", () => resolveCredential("stripe/acme")),
-      ).resolves.toBe("stripe-secret");
+        runInPluginContext("imessage", () => resolveCredential("imessage/api_key")),
+      ).resolves.toBe("comms-key");
       await expect(
-        runInPluginContext("acme", () => resolveCredential("openai/acme")),
-      ).resolves.toBe("openai-secret");
+        runInPluginContext("imessage", () =>
+          resolveCredential("imessage/photon_project_id"),
+        ),
+      ).resolves.toBe("proj-id");
     });
   });
 });

package/src/__tests__/plugin-api-shim.test.ts

@@ -136,9 +136,14 @@ describe("ensurePluginApiShim", () => {
         `}));\n`,
     );
 
+    // Explicit env spread: under bun test, a child's default env reflects the
+    // process-start environ, not later process.env mutations. Without this
+    // the child misses the preload's VELLUM_WORKSPACE_DIR and resolves the
+    // real ~/.vellum/workspace (refused by the live-workspace guard).
     const result = spawnSync(process.execPath, ["run", probe], {
       encoding: "utf8",
       timeout: 30_000,
+      env: { ...process.env },
     });
     expect(result.status).toBe(0);
     const lastLine = result.stdout.trim().split("\n").at(-1) ?? "";