@vellumai/assistant 0.11.4 → 0.11.5-staging.2

package/src/__tests__/platform.test.ts

@@ -1,7 +1,7 @@
 import { existsSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, describe, expect, test } from "bun:test";
 
 import {
   ensureDataDir,
@@ -23,6 +23,21 @@ import {
 } from "../util/platform.js";
 
 const originalWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR;
+
+// This file characterizes path resolution itself (including the ~/.vellum
+// fallback and literal override paths) without reading or writing those
+// locations, so the live-workspace guard is deliberately bypassed.
+const originalAllowRealWorkspace =
+  process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS = "1";
+afterAll(() => {
+  if (originalAllowRealWorkspace === undefined) {
+    delete process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS;
+  } else {
+    process.env.VELLUM_ALLOW_REAL_WORKSPACE_IN_TESTS =
+      originalAllowRealWorkspace;
+  }
+});
 const originalVellumEnvironment = process.env.VELLUM_ENVIRONMENT;
 const originalXdgConfigHome = process.env.XDG_CONFIG_HOME;
 

package/src/__tests__/plugin-api-resolve-credential.test.ts

@@ -102,21 +102,28 @@ describe("resolveCredential", () => {
   });
 
   describe("plugin scoping", () => {
-    test("allows a plugin to resolve a credential whose field matches its name", async () => {
-      seedCredential("openai", "acme", "scoped-secret");
-      const value = await runInPluginContext("acme", () =>
-        resolveCredential("openai/acme"),
+    test("allows a plugin to resolve a credential whose service matches its name", async () => {
+      seedCredential("imessage", "api_key", "comms-key");
+      const value = await runInPluginContext("imessage", () =>
+        resolveCredential("imessage/api_key"),
       );
-      expect(value).toBe("scoped-secret");
+      expect(value).toBe("comms-key");
     });
 
-    test("blocks a plugin from resolving a credential whose field differs from its name", async () => {
+    test("blocks a plugin from resolving another service", async () => {
       seedCredential("openai", "api_key", "sk-secret");
       await expect(
         runInPluginContext("acme", () => resolveCredential("openai/api_key")),
       ).rejects.toThrow(/out of scope/);
     });
 
+    test("blocks a plugin from resolving another service even when the field matches its name", async () => {
+      seedCredential("openai", "acme", "scoped-secret");
+      await expect(
+        runInPluginContext("acme", () => resolveCredential("openai/acme")),
+      ).rejects.toThrow(/out of scope/);
+    });
+
     test("does not read the secure backend when out of scope", async () => {
       seedCredential("openai", "api_key", "sk-secret");
       getSpy.mockClear();
@@ -126,15 +133,17 @@ describe("resolveCredential", () => {
       expect(getSpy).not.toHaveBeenCalled();
     });
 
-    test("scoping applies by field only, across any service", async () => {
-      seedCredential("stripe", "acme", "stripe-secret");
-      seedCredential("openai", "acme", "openai-secret");
+    test("scoping applies to every field under the plugin's service", async () => {
+      seedCredential("imessage", "api_key", "comms-key");
+      seedCredential("imessage", "photon_project_id", "proj-id");
       await expect(
-        runInPluginContext("acme", () => resolveCredential("stripe/acme")),
-      ).resolves.toBe("stripe-secret");
+        runInPluginContext("imessage", () => resolveCredential("imessage/api_key")),
+      ).resolves.toBe("comms-key");
       await expect(
-        runInPluginContext("acme", () => resolveCredential("openai/acme")),
-      ).resolves.toBe("openai-secret");
+        runInPluginContext("imessage", () =>
+          resolveCredential("imessage/photon_project_id"),
+        ),
+      ).resolves.toBe("proj-id");
     });
   });
 });

package/src/__tests__/plugin-api-shim.test.ts

@@ -136,9 +136,14 @@ describe("ensurePluginApiShim", () => {
         `}));\n`,
     );
 
+    // Explicit env spread: under bun test, a child's default env reflects the
+    // process-start environ, not later process.env mutations. Without this
+    // the child misses the preload's VELLUM_WORKSPACE_DIR and resolves the
+    // real ~/.vellum/workspace (refused by the live-workspace guard).
     const result = spawnSync(process.execPath, ["run", probe], {
       encoding: "utf8",
       timeout: 30_000,
+      env: { ...process.env },
     });
     expect(result.status).toBe(0);
     const lastLine = result.stdout.trim().split("\n").at(-1) ?? "";

package/src/__tests__/plugin-api-store-credential.test.ts

@@ -0,0 +1,268 @@
+import { randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  afterAll,
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  spyOn,
+  test,
+} from "bun:test";
+
+import { credentialKey } from "@vellumai/credential-storage";
+
+import * as scrub from "../daemon/credential-transcript-scrub.js";
+import * as manualToken from "../oauth/manual-token-connection.js";
+import { resolveCredential } from "../plugin-api/resolve-credential.js";
+import {
+  CredentialStoreError,
+  storeCredential,
+} from "../plugin-api/store-credential.js";
+import { runInPluginContext } from "../plugins/plugin-execution-context.js";
+import * as secureKeys from "../security/secure-keys.js";
+import {
+  _setMetadataPath,
+  getCredentialMetadata,
+} from "../tools/credentials/metadata-store.js";
+import { storeCredentialValue } from "../tools/credentials/store.js";
+
+// Real metadata store backed by a temp file. A mock.module on metadata-store
+// or secure-keys would replace the whole module namespace, so only the secure
+// backend access, the transcript scrub, and the manual-token connection sync
+// are intercepted, via restorable spies.
+
+const TEST_DIR = join(
+  tmpdir(),
+  `vellum-plugin-storecred-${randomBytes(4).toString("hex")}`,
+);
+const META_PATH = join(TEST_DIR, "metadata.json");
+
+/** The plugin every scoped case runs as: it owns the `acme` service. */
+const PLUGIN = "acme";
+
+/** Run `fn` as the plugin would: inside its execution context. */
+function asPlugin<T>(fn: () => T): T {
+  return runInPluginContext(PLUGIN, fn);
+}
+
+let secureStore: Map<string, string>;
+let writeSucceeds: boolean;
+let setSpy: ReturnType<typeof spyOn>;
+let getSpy: ReturnType<typeof spyOn>;
+let scrubSpy: ReturnType<typeof spyOn>;
+let syncSpy: ReturnType<typeof spyOn>;
+
+beforeEach(() => {
+  if (existsSync(TEST_DIR)) {
+    rmSync(TEST_DIR, { recursive: true });
+  }
+  mkdirSync(TEST_DIR, { recursive: true });
+  _setMetadataPath(META_PATH);
+
+  secureStore = new Map();
+  writeSucceeds = true;
+  setSpy = spyOn(secureKeys, "setSecureKeyAsync").mockImplementation(
+    async (key: string, value: string) => {
+      if (!writeSucceeds) {
+        return false;
+      }
+      secureStore.set(key, value);
+      return true;
+    },
+  );
+  getSpy = spyOn(secureKeys, "getSecureKeyResultAsync").mockImplementation(
+    async (key: string) => ({
+      value: secureStore.get(key),
+      unreachable: false,
+    }),
+  );
+  scrubSpy = spyOn(
+    scrub,
+    "scrubStoredCredentialFromTranscripts",
+  ).mockImplementation(async () => ({
+    dbMessagesScrubbed: 0,
+    residentMessagesScrubbed: 0,
+  }));
+  syncSpy = spyOn(manualToken, "syncManualTokenConnection").mockImplementation(
+    async () => {},
+  );
+});
+
+afterEach(() => {
+  setSpy.mockRestore();
+  getSpy.mockRestore();
+  scrubSpy.mockRestore();
+  syncSpy.mockRestore();
+});
+
+afterAll(() => {
+  _setMetadataPath(null);
+  if (existsSync(TEST_DIR)) {
+    rmSync(TEST_DIR, { recursive: true });
+  }
+});
+
+describe("storeCredential", () => {
+  test("creates a credential from a service/field ref", async () => {
+    const stored = await asPlugin(() =>
+      storeCredential("acme/api_key", "sk-secret"),
+    );
+
+    expect(stored.service).toBe("acme");
+    expect(stored.field).toBe("api_key");
+    expect(stored.credentialId).toBeTruthy();
+    expect(secureStore.get(credentialKey("acme", "api_key"))).toBe("sk-secret");
+    expect(getCredentialMetadata("acme", "api_key")?.credentialId).toBe(
+      stored.credentialId,
+    );
+  });
+
+  test("stores a value that resolveCredential reads back", async () => {
+    await asPlugin(() => storeCredential("acme/api_key", "sk-secret"));
+    await expect(
+      asPlugin(() => resolveCredential("acme/api_key")),
+    ).resolves.toBe("sk-secret");
+  });
+
+  test("trims edge whitespace from the value", async () => {
+    await asPlugin(() => storeCredential("acme/api_key", "  sk-secret\n"));
+    expect(secureStore.get(credentialKey("acme", "api_key"))).toBe("sk-secret");
+  });
+
+  test("records label and description on the credential metadata", async () => {
+    await asPlugin(() =>
+      storeCredential("acme/api_key", "sk-secret", {
+        label: "Acme key",
+        description: "Used by the acme plugin",
+      }),
+    );
+
+    const metadata = getCredentialMetadata("acme", "api_key");
+    expect(metadata?.alias).toBe("Acme key");
+    expect(metadata?.usageDescription).toBe("Used by the acme plugin");
+  });
+
+  test("replaces the value of an existing credential named by UUID", async () => {
+    const first = await asPlugin(() =>
+      storeCredential("acme/api_key", "sk-old"),
+    );
+    const second = await asPlugin(() =>
+      storeCredential(first.credentialId, "sk-new"),
+    );
+
+    expect(second).toEqual(first);
+    expect(secureStore.get(credentialKey("acme", "api_key"))).toBe("sk-new");
+  });
+
+  test("rejects a ref that names no credential and is not service/field", async () => {
+    await expect(
+      asPlugin(() => storeCredential("openai", "sk-secret")),
+    ).rejects.toBeInstanceOf(CredentialStoreError);
+    expect(setSpy).not.toHaveBeenCalled();
+  });
+
+  test("rejects an empty value", async () => {
+    await expect(
+      asPlugin(() => storeCredential("acme/api_key", "   ")),
+    ).rejects.toThrow(/value is required/);
+    expect(setSpy).not.toHaveBeenCalled();
+  });
+
+  test("surfaces a failed secure-backend write", async () => {
+    writeSucceeds = false;
+    await expect(
+      asPlugin(() => storeCredential("acme/api_key", "sk-secret")),
+    ).rejects.toThrow(CredentialStoreError);
+    expect(getCredentialMetadata("acme", "api_key")).toBeUndefined();
+  });
+
+  test("scrubs the stored value from recent transcripts", async () => {
+    await asPlugin(() => storeCredential("acme/api_key", "sk-secret"));
+    expect(scrubSpy).toHaveBeenCalledWith("sk-secret");
+  });
+
+  test("skips the transcript scrub when asked", async () => {
+    await asPlugin(() =>
+      storeCredential("acme/api_key", "sk-secret", {
+        skipTranscriptScrub: true,
+      }),
+    );
+    expect(scrubSpy).not.toHaveBeenCalled();
+  });
+
+  test("reconciles the manual-token connection for the service", async () => {
+    await asPlugin(() => storeCredential("acme/api_key", "sk-secret"));
+    expect(syncSpy).toHaveBeenCalledWith("acme");
+  });
+
+  describe("plugin scoping", () => {
+    test("fails closed with no plugin in context", async () => {
+      // A plugin's module body is evaluated outside any context. An unscoped
+      // branch there would let top-level code overwrite the user's own
+      // credentials, so the write is refused instead.
+      await expect(storeCredential("acme/api_key", "sk-secret")).rejects.toThrow(
+        /requires an active plugin execution context/,
+      );
+      expect(setSpy).not.toHaveBeenCalled();
+      expect(getCredentialMetadata("acme", "api_key")).toBeUndefined();
+    });
+
+    test("blocks a plugin from storing a credential it does not own", async () => {
+      await expect(
+        asPlugin(() => storeCredential("openai/api_key", "sk-secret")),
+      ).rejects.toThrow(/out of scope/);
+    });
+
+    test("does not write the secure backend when out of scope", async () => {
+      await expect(
+        asPlugin(() => storeCredential("openai/api_key", "sk-secret")),
+      ).rejects.toThrow(CredentialStoreError);
+      expect(setSpy).not.toHaveBeenCalled();
+      expect(getCredentialMetadata("openai", "api_key")).toBeUndefined();
+    });
+
+    test("blocks a plugin from overwriting another credential by UUID", async () => {
+      // Seeded through the host write path, the way the user's own credential
+      // is created (`credentials set`), not through the plugin API.
+      const existing = await storeCredentialValue({
+        service: "openai",
+        field: "api_key",
+        value: "sk-user",
+        skipTranscriptScrub: true,
+      });
+      setSpy.mockClear();
+
+      await expect(
+        asPlugin(() => storeCredential(existing.credentialId, "sk-hijacked")),
+      ).rejects.toThrow(/out of scope/);
+      expect(setSpy).not.toHaveBeenCalled();
+      expect(secureStore.get(credentialKey("openai", "api_key"))).toBe(
+        "sk-user",
+      );
+    });
+
+    test("blocks a plugin from storing another service even when the field matches its name", async () => {
+      await expect(
+        asPlugin(() => storeCredential("openai/acme", "sk-secret")),
+      ).rejects.toThrow(/out of scope/);
+      expect(setSpy).not.toHaveBeenCalled();
+    });
+
+    test("allows a plugin to store multiple fields under its own service", async () => {
+      await asPlugin(async () => {
+        await storeCredential("acme/api_key", "key-secret");
+        await storeCredential("acme/token", "token-secret");
+      });
+
+      expect(secureStore.get(credentialKey("acme", "api_key"))).toBe(
+        "key-secret",
+      );
+      expect(secureStore.get(credentialKey("acme", "token"))).toBe(
+        "token-secret",
+      );
+    });
+  });
+});

package/src/__tests__/plugin-config-data-migration.test.ts

@@ -32,7 +32,10 @@ import {
   populateCacheAtBoot,
   resetPluginCacheForTests,
 } from "../plugins/mtime-cache.js";
-import { PRESERVED_ENTRIES } from "../plugins/plugin-tree-walk.js";
+import {
+  PRESERVED_ENTRIES,
+  USER_STATE_ENTRIES,
+} from "../plugins/plugin-tree-walk.js";
 
 const ROOT = join(
   tmpdir(),
@@ -87,6 +90,10 @@ describe("PRESERVED_ENTRIES", () => {
     expect(PRESERVED_ENTRIES).toContain("data");
     expect(PRESERVED_ENTRIES).toContain(".disabled");
   });
+
+  test("user-state entries are the preserved set minus the provenance sidecar", () => {
+    expect([...USER_STATE_ENTRIES]).toEqual(["config.json", "data", ".disabled"]);
+  });
 });
 
 describe("fingerprint exclusion of preserved entries", () => {

package/src/__tests__/plugin-disabled-state.test.ts

@@ -22,6 +22,7 @@ import {
   getRegisteredInjectors,
   registerPluginInjectors,
 } from "../plugins/injector-registry.js";
+import { resetPluginCacheForTests } from "../plugins/mtime-cache.js";
 import {
   registerPlugin,
   resetPluginRegistryForTests,
@@ -85,6 +86,7 @@ function makeFakeTool(name: string): Tool {
 
 beforeEach(() => {
   resetPluginRegistryForTests();
+  resetPluginCacheForTests();
   clearInjectorRegistry();
 });
 

package/src/__tests__/plugin-effective-enabled-set.test.ts

@@ -8,14 +8,18 @@
  * non-null Set is an allowlist, `null` means no restriction. This suite locks
  * the contract that the hook gather sites honor it:
  *  - `getHooksFor(name, { conversationId })` resolves the conversation's scope
- *    and excludes in-process default-plugin hooks outside it; omitting the
+ *    and excludes user-plugin hooks outside it. First-party default plugins
+ *    always remain (they are core runtime, not per-chat toggles). Omitting the
  *    conversationId imposes no restriction.
+ *  - `getUserHooksFor` returns those same in-process default-plugin hooks
+ *    (plus user-land hooks), not only filesystem plugins.
  *  - `collectUserHookEntries(name, dirs, set)` excludes user-land plugin hooks
  *    outside the set, while standalone workspace hooks (not owned by a plugin)
  *    still run.
  *
  * The per-chat scope layers on top of (does not replace) the global
- * `.disabled` sentinel check — a plugin excluded by either is excluded.
+ * `.disabled` sentinel check. A user plugin excluded by either is excluded.
+ * A first-party default plugin is excluded only by `.disabled`.
  * Injectors are intentionally NOT per-chat scoped (see
  * `getRegisteredInjectors`): they run inside already-scoped plugin hooks, and
  * every injector-contributing plugin is a first-party default.
@@ -39,7 +43,8 @@ import {
   collectUserHookEntries,
   resetHookCacheForTests,
 } from "../hooks/hook-loader.js";
-import { getHooksFor } from "../hooks/registry.js";
+import { getHooksFor, getUserHooksFor } from "../hooks/registry.js";
+import { resetPluginCacheForTests } from "../plugins/mtime-cache.js";
 import {
   registerPlugin,
   resetPluginRegistryForTests,
@@ -66,6 +71,7 @@ function buildPlugin(
 describe("getHooksFor per-chat plugin scope (in-process default hooks)", () => {
   beforeEach(() => {
     resetPluginRegistryForTests();
+    resetPluginCacheForTests();
     resolveScopeMock.mockReset();
     resolveScopeMock.mockImplementation(() => null);
   });
@@ -136,6 +142,52 @@ describe("getHooksFor per-chat plugin scope (in-process default hooks)", () => {
       await getHooksFor("user-prompt-submit", { conversationId: "c1" }),
     ).toHaveLength(0);
   });
+
+  test("getUserHooksFor returns in-process default plugin hooks", async () => {
+    registerPlugin(
+      buildPlugin("default-memory", {
+        "user-prompt-submit": () => Promise.resolve(),
+      }),
+    );
+    expect(await getUserHooksFor("user-prompt-submit")).toHaveLength(1);
+  });
+
+  test("a first-party default plugin's hooks run even when the chat scope omits it", async () => {
+    let ran = 0;
+    registerPlugin(
+      buildPlugin("default-memory", {
+        "user-prompt-submit": () => {
+          ran++;
+          return Promise.resolve();
+        },
+      }),
+    );
+    resolveScopeMock.mockImplementation(() => new Set(["user-a"]));
+
+    const hooks = await getHooksFor("user-prompt-submit", {
+      conversationId: "c1",
+    });
+    expect(hooks).toHaveLength(1);
+    await hooks[0]!({});
+    expect(ran).toBe(1);
+  });
+
+  test("a workspace-disabled first-party default is still excluded", async () => {
+    registerPlugin(
+      buildPlugin("default-memory", {
+        "user-prompt-submit": () => Promise.resolve(),
+      }),
+    );
+    const dir = join(getWorkspacePluginsDir(), "default-memory");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, ".disabled"), "");
+    try {
+      expect(await getHooksFor("user-prompt-submit")).toHaveLength(0);
+      expect(await getUserHooksFor("user-prompt-submit")).toHaveLength(0);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
 });
 
 describe("collectUserHookEntries per-chat plugin scope (user-land hooks)", () => {

package/src/__tests__/plugin-execution-context.test.ts

@@ -0,0 +1,73 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  getCurrentPluginName,
+  runInPluginContext,
+  runOutsidePluginContext,
+} from "../plugins/plugin-execution-context.js";
+
+describe("plugin execution context", () => {
+  test("reports no plugin outside any context", () => {
+    expect(getCurrentPluginName()).toBeUndefined();
+  });
+
+  test("marks the plugin for the duration of the call", () => {
+    const seen = runInPluginContext("acme", () => getCurrentPluginName());
+    expect(seen).toBe("acme");
+    expect(getCurrentPluginName()).toBeUndefined();
+  });
+
+  test("carries across await boundaries", async () => {
+    const seen = await runInPluginContext("acme", async () => {
+      await Promise.resolve();
+      return getCurrentPluginName();
+    });
+    expect(seen).toBe("acme");
+  });
+
+  test("the innermost plugin wins when contexts nest", () => {
+    const seen = runInPluginContext("outer", () =>
+      runInPluginContext("inner", () => getCurrentPluginName()),
+    );
+    expect(seen).toBe("inner");
+  });
+
+  describe("runOutsidePluginContext", () => {
+    // Host code reached from a plugin (a default tool run during a turn a
+    // plugin route started) is not the plugin's code and must not borrow its
+    // identity, or a scoped API would attribute that work to the plugin.
+    test("clears a surrounding plugin context", () => {
+      const seen = runInPluginContext("acme", () =>
+        runOutsidePluginContext(() => getCurrentPluginName()),
+      );
+      expect(seen).toBeUndefined();
+    });
+
+    test("keeps the context cleared across await boundaries", async () => {
+      const seen = await runInPluginContext("acme", () =>
+        runOutsidePluginContext(async () => {
+          await Promise.resolve();
+          return getCurrentPluginName();
+        }),
+      );
+      expect(seen).toBeUndefined();
+    });
+
+    test("restores the plugin context for work after it", () => {
+      const seen = runInPluginContext("acme", () => {
+        runOutsidePluginContext(() => getCurrentPluginName());
+        return getCurrentPluginName();
+      });
+      expect(seen).toBe("acme");
+    });
+
+    test("a plugin context inside it scopes to the inner plugin", () => {
+      const seen = runInPluginContext("acme", () =>
+        runOutsidePluginContext(() =>
+          runInPluginContext("other", () => getCurrentPluginName()),
+        ),
+      );
+      expect(seen).toBe("other");
+    });
+  });
+});

package/src/__tests__/plugin-import-boundary-guard.test.ts

@@ -99,7 +99,6 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../../../security/untrusted-content.js",
     "../../../../api/events/memory-recalled.js",
     "../../../../api/responses/memory-v3-selection-log.js",
-    "../../../../channels/types.js",
     "../../../../config/assistant-feature-flags.js",
     "../../../../config/default-profile-catalog.js",
     "../../../../config/loader.js",

package/src/__tests__/plugin-import-boundary-reverse-guard.test.ts

@@ -99,7 +99,6 @@ const BASELINE: Record<string, readonly string[]> = {
     "src/daemon/handlers/skills.ts",
     "src/daemon/skill-memory-refresh.ts",
     "src/daemon/tool-side-effects.ts",
-    "src/daemon/trust-context.ts",
     "src/home/feed-source-enrichment.ts",
     "src/permissions/checker.ts",
     "src/persistence/conversation-crud.ts",