@vellumai/assistant 0.11.4 → 0.11.5-staging.2

package/src/__tests__/conversation-pairing.test.ts

@@ -47,6 +47,14 @@ const getConversationMock = mock((id: string) => {
   return mockExistingConversations[id] ?? null;
 });
 
+const messagesInvalidated: string[] = [];
+
+mock.module("../runtime/sync/resource-sync-events.js", () => ({
+  publishConversationMessagesChanged: (conversationId: string) => {
+    messagesInvalidated.push(conversationId);
+  },
+}));
+
 mock.module("../persistence/conversation-crud.js", () => ({
   setConversationProcessingStartedAt: () => {},
   isConversationProcessing: () => false,
@@ -144,6 +152,7 @@ describe("pairDeliveryWithConversation", () => {
   beforeEach(() => {
     createConversationMock.mockClear();
     addMessageMock.mockClear();
+    messagesInvalidated.length = 0;
     getConversationMock.mockClear();
     getBindingByChannelChatMock.mockClear();
     upsertOutboundBindingMock.mockClear();
@@ -870,6 +879,183 @@ describe("pairDeliveryWithConversation", () => {
     expect(addMessageMock).not.toHaveBeenCalled();
   });
 
+  // ── Passive default: body appended to the producing conversation ───
+  //
+  // The home feed points "Go to Conversation" at `sourceContextId`, so the
+  // body has to land there for that button to open something that contains
+  // the notification the user tapped.
+
+  test("passive vellum signal appends the body to the producing conversation", async () => {
+    mockExistingConversations["conv-producer"] = {
+      id: "conv-producer",
+      source: "schedule",
+      title: "Daily Briefing Delivery",
+    };
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceContextId: "conv-producer",
+    });
+    const copy = makeCopy({ body: "Daily Briefing for Tuesday." });
+
+    const result = await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      copy,
+    );
+
+    expect(result.conversationId).toBe("conv-producer");
+    expect(result.messageId).toBe("msg-001");
+    expect(result.createdNewConversation).toBe(false);
+    expect(result.conversationFallbackUsed).toBe(false);
+    // Appending must never mint a sidebar entry.
+    expect(createConversationMock).not.toHaveBeenCalled();
+    expect(addMessageMock).toHaveBeenCalledTimes(1);
+    const [conversationId, role] = addMessageMock.mock.calls[0]!;
+    expect(conversationId).toBe("conv-producer");
+    expect(role).toBe("assistant");
+    // `addMessage` publishes the metadata tag alone, so a client holding this
+    // conversation open needs the messages tag to refetch the transcript.
+    expect(messagesInvalidated).toContain("conv-producer");
+  });
+
+  test("appends for a foreground producer the home feed will not mirror", async () => {
+    // `resolveHomeFeedMirror` declines a signal that is neither
+    // `assistant_tool`, nor flagged async-background, nor produced by a
+    // background-typed conversation, so no card is written for this one. The
+    // append is deliberately not gated on that: the vellum banner still
+    // deep-links to this conversation, and the client suppresses the banner
+    // entirely when the user is already viewing it, leaving the transcript as
+    // the only place the notification can land.
+    mockExistingConversations["conv-foreground"] = {
+      id: "conv-foreground",
+      source: "user",
+      title: "An ordinary chat",
+    };
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceChannel: "plugin",
+      sourceContextId: "conv-foreground",
+      attentionHints: {
+        requiresAction: false,
+        urgency: "medium",
+        isAsyncBackground: false,
+        visibleInSourceNow: false,
+      },
+    });
+    const copy = makeCopy({ body: "Something you asked to watch changed." });
+
+    const result = await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      copy,
+    );
+
+    expect(result.conversationId).toBe("conv-foreground");
+    expect(createConversationMock).not.toHaveBeenCalled();
+    expect(addMessageMock).toHaveBeenCalledTimes(1);
+    expect(messagesInvalidated).toContain("conv-foreground");
+  });
+
+  test("appended notification body skips indexing", async () => {
+    mockExistingConversations["conv-producer"] = {
+      id: "conv-producer",
+      source: "schedule",
+      title: null,
+    };
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceContextId: "conv-producer",
+    });
+
+    await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      makeCopy(),
+    );
+
+    const options = addMessageMock.mock.calls[0]![3] as {
+      skipIndexing?: boolean;
+    };
+    expect(options.skipIndexing).toBe(true);
+  });
+
+  test("passive vellum signal appends regardless of the producing conversation's source", async () => {
+    // The reuse_existing branch requires a source match; appending to the
+    // producing conversation does not, since the row already exists and the
+    // feed links to it either way.
+    mockExistingConversations["conv-producer"] = {
+      id: "conv-producer",
+      source: "user",
+      title: null,
+    };
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceContextId: "conv-producer",
+      conversationMetadata: { source: "notification" },
+    });
+
+    const result = await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      makeCopy(),
+    );
+
+    expect(result.conversationId).toBe("conv-producer");
+    expect(createConversationMock).not.toHaveBeenCalled();
+  });
+
+  test("passive vellum signal with a sentinel sourceContextId appends nothing", async () => {
+    // Producers pass job ids, call session ids and `access-req-*` strings
+    // here. Those resolve to no row, which matches the feed hiding the button.
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceContextId: "job-1234",
+    });
+
+    const result = await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      makeCopy(),
+    );
+
+    expect(result.conversationId).toBeNull();
+    expect(result.messageId).toBeNull();
+    expect(createConversationMock).not.toHaveBeenCalled();
+    expect(addMessageMock).not.toHaveBeenCalled();
+  });
+
+  test("passive vellum signal appends to the producer, not the reuse_existing target", async () => {
+    mockExistingConversations["conv-producer"] = {
+      id: "conv-producer",
+      source: "schedule",
+      title: null,
+    };
+    mockExistingConversations["conv-hinted"] = {
+      id: "conv-hinted",
+      source: "notification",
+      title: null,
+    };
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceContextId: "conv-producer",
+    });
+    const conversationAction: ConversationAction = {
+      action: "reuse_existing",
+      conversationId: "conv-hinted",
+    };
+
+    const result = await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      makeCopy(),
+      { conversationAction },
+    );
+
+    expect(result.conversationId).toBe("conv-producer");
+    expect(addMessageMock).toHaveBeenCalledTimes(1);
+    expect(addMessageMock.mock.calls[0]![0]).toBe("conv-producer");
+  });
+
   // ── conversationMetadata.conversationType override ─────────────────
 
   test("uses conversationMetadata.conversationType when set, overriding channel strategy", async () => {

package/src/__tests__/conversation-runtime-assembly.test.ts

@@ -1496,6 +1496,17 @@ describe("stripInjectionsForCompaction memory/info wrapper matching", () => {
 // applyRuntimeInjections with nowScratchpad
 // ---------------------------------------------------------------------------
 
+/**
+ * Personal-memory content (NOW.md, PKB, v3 cards) is gated on the actor's
+ * trust class, so suites asserting that content have to name the actor they
+ * are about. Left unset, the injector substitutes the low-trust fallback and
+ * the assertion silently becomes a test of the gate instead of the content.
+ */
+const GUARDIAN_TRUST_FIXTURE = {
+  trustClass: "guardian",
+  sourceChannel: "vellum",
+} as const;
+
 describe("applyRuntimeInjections with nowScratchpad", () => {
   const baseMessages: Message[] = [
     {
@@ -1513,6 +1524,7 @@ describe("applyRuntimeInjections with nowScratchpad", () => {
     seedNowScratchpad("Current focus: fix the bug");
     const { messages: result } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
     });
 
     expect(result.length).toBe(1);
@@ -1527,6 +1539,7 @@ describe("applyRuntimeInjections with nowScratchpad", () => {
     seedNowScratchpad("scratchpad notes");
     const { messages: result } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
     });
 
     // Scratchpad comes first (before user content)
@@ -1542,6 +1555,7 @@ describe("applyRuntimeInjections with nowScratchpad", () => {
   test("does not inject when the NOW.md file is absent", async () => {
     const { messages: result } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
     });
 
     expect(result.length).toBe(1);
@@ -1552,6 +1566,7 @@ describe("applyRuntimeInjections with nowScratchpad", () => {
     seedNowScratchpad("Current focus: fix the bug");
     const { messages: result } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
       mode: "minimal",
     });
 
@@ -2873,6 +2888,7 @@ describe("applyRuntimeInjections — PKB relevance hints", () => {
   function makePkbOptions(overrides: Record<string, unknown> = {}) {
     return {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
       ...overrides,
     };
   }
@@ -3159,7 +3175,7 @@ describe("applyRuntimeInjections — PKB relevance hints", () => {
     // filtered out.
     const { messages: initialResult } = await applyRuntimeInjections(
       preCompactionMessages,
-      { conversationId: FALLBACK_CONVERSATION_ID },
+      makePkbOptions(),
     );
     // Unwrap the injected reminder from the last user message.
     const initialTexts = extractTexts(initialResult);
@@ -3193,7 +3209,7 @@ describe("applyRuntimeInjections — PKB relevance hints", () => {
     // should be filtered, and beta (no longer "in context") should appear.
     const { messages: rebuiltResult } = await applyRuntimeInjections(
       postCompactionMessages,
-      { conversationId: FALLBACK_CONVERSATION_ID },
+      makePkbOptions(),
     );
     const rebuiltTexts = extractTexts(rebuiltResult);
     const rebuiltReminder = rebuiltTexts.find(
@@ -6652,6 +6668,7 @@ describe("applyRuntimeInjections blocks.pkbSystemReminder", () => {
     pkbSearchThrows = null;
     const { blocks } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
       mode: "full",
     });
 
@@ -6663,6 +6680,7 @@ describe("applyRuntimeInjections blocks.pkbSystemReminder", () => {
     seedPkbContent();
     const { blocks } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
       mode: "minimal",
     });
 
@@ -6672,6 +6690,7 @@ describe("applyRuntimeInjections blocks.pkbSystemReminder", () => {
   test("not captured when PKB inactive", async () => {
     const { blocks } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
       mode: "full",
     });
 

package/src/__tests__/credential-broker-server-use.test.ts

@@ -44,8 +44,24 @@ import { setSecureKeyAsync } from "../security/secure-keys.js";
 import { CredentialBroker } from "../tools/credentials/broker.js";
 import {
   _setMetadataPath,
+  type CredentialMetadata,
   upsertCredentialMetadata,
 } from "../tools/credentials/metadata-store.js";
+import { serverUseDenialReason } from "../tools/credentials/tool-policy.js";
+
+/** The shared policy's verdict for a state the broker must also deny. */
+function sharedDenialReason(
+  metadata: CredentialMetadata,
+  toolName: string,
+  service: string,
+  field: string,
+): string {
+  const reason = serverUseDenialReason(metadata, toolName, service, field);
+  if (!reason) {
+    throw new Error("expected a denial reason from the shared policy");
+  }
+  return reason;
+}
 
 // ---------------------------------------------------------------------------
 // Tests — serverUse (publish_page / unpublish_page regression)
@@ -518,9 +534,10 @@ describe("CredentialBroker.serverUseById", () => {
     if (result.success) {
       throw new Error("expected denial");
     }
-    expect(result.reason).toContain("not allowed");
-    expect(result.reason).toContain("unauthorized_tool");
-    expect(result.reason).toContain("media_proxy");
+    // The broker passes the shared server-use policy's verdict through verbatim.
+    expect(result.reason).toBe(
+      sharedDenialReason(meta, "unauthorized_tool", "fal", "api_key"),
+    );
   });
 
   test("returns not found for unknown credential ID", async () => {
@@ -553,8 +570,10 @@ describe("CredentialBroker.serverUseById", () => {
     if (result.success) {
       throw new Error("expected denial");
     }
-    expect(result.reason).toContain("domain restrictions");
-    expect(result.reason).toContain("cannot be used server-side");
+    // The broker passes the shared server-use policy's verdict through verbatim.
+    expect(result.reason).toBe(
+      sharedDenialReason(meta, "media_proxy", "github", "oauth_token"),
+    );
   });
 
   test("returns empty injection templates when credential has none", async () => {

package/src/__tests__/credential-routes.test.ts

@@ -146,6 +146,7 @@ mock.module("../tools/credentials/broker.js", () => ({
 }));
 
 import { persistPromptedCredential } from "../credential-execution/prompted-credential.js";
+import { initializeDb } from "../persistence/db-init.js";
 import {
   forChatMintsSince,
   resetForChatMintRegistryForTest,
@@ -158,6 +159,12 @@ import {
 } from "../runtime/reveal-success-registry.js";
 import { ROUTES } from "../runtime/routes/credential-routes.js";
 
+// A delete looks up the provider connections that resolve their auth through
+// the credential, so the inference schema has to exist. No connection is
+// created here: the refusal is covered by
+// runtime/routes/__tests__/credential-delete-in-use.test.ts.
+await initializeDb();
+
 const setRoute = ROUTES.find((r) => r.operationId === "credentials_set");
 const listRoute = ROUTES.find((r) => r.operationId === "credentials_list");
 const deleteRoute = ROUTES.find((r) => r.operationId === "credentials_delete");
@@ -173,7 +180,11 @@ type ListResponse = {
   }>;
   managedCredentials: unknown[];
 };
-type DeleteResponse = { service: string; field: string };
+type DeleteResponse = {
+  service: string;
+  field: string;
+  affectedConnections: string[];
+};
 
 const SECRET_VALUE = "super-secret-token-value";
 
@@ -786,7 +797,11 @@ describe("credentials routes", () => {
       })) as DeleteResponse;
 
       // THEN the response echoes the identifiers
-      expect(result).toEqual({ service: "vercel", field: "api_token" });
+      expect(result).toEqual({
+        service: "vercel",
+        field: "api_token",
+        affectedConnections: [],
+      });
 
       // AND the secret and metadata are gone
       expect(secureStore.has("vercel:api_token")).toBe(false);
@@ -811,7 +826,11 @@ describe("credentials routes", () => {
       })) as DeleteResponse;
 
       // THEN the response echoes the identifiers
-      expect(result).toEqual({ service: "slack_channel", field: "user_token" });
+      expect(result).toEqual({
+        service: "slack_channel",
+        field: "user_token",
+        affectedConnections: [],
+      });
 
       // AND only the user_token is removed; bot + app tokens remain
       expect(secureStore.has("slack_channel:user_token")).toBe(false);

package/src/__tests__/credential-security-invariants.test.ts

@@ -237,7 +237,8 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "tools/network/web-fetch.ts", // Firecrawl /scrape BYOK fetch provider API key lookup (firecrawl provider key)
       "workspace/default-provider-ensure.ts", // legacy anthropic echo disambiguation (vault key presence check)
       "providers/inference/connection-availability.ts", // shared (provider, connection) availability status (credential presence check only; value never leaves the helper)
-      "plugin-api/resolve-credential.ts", // plugin-facing resolveCredential — reveal-equivalent plaintext read, scoped to the in-context plugin's own field
+      "plugin-api/resolve-credential.ts", // plugin-facing resolveCredential: reveal-equivalent plaintext read, scoped to the in-context plugin's own service
+      "tools/credentials/store.ts", // shared credential write path (setSecureKeyAsync only; no reads) behind credentials/set and plugin-facing storeCredential
     ]);
 
     const thisDir = dirname(fileURLToPath(import.meta.url));

package/src/__tests__/daemon-credential-client.test.ts

@@ -104,6 +104,60 @@ describe("daemon credential client", () => {
       expect(result.error).toBe("Credential store is unreachable");
     });
 
+    test("refuses to delete around the in-use guard when the daemon is down", async () => {
+      /**
+       * The guard runs daemon-side, so a stopped daemon must not turn into an
+       * unchecked direct delete.
+       */
+
+      // GIVEN a stored credential and no reachable daemon
+      _ipcResponse = {
+        ok: false,
+        error: "Could not connect to assistant daemon. Is it running?",
+      };
+      await setSecureKeyViaDaemon("api_key", "guarded-provider", "keep-me");
+
+      // WHEN the delete is attempted without force
+      const result = await deleteSecureKeyViaDaemon(
+        "api_key",
+        "guarded-provider",
+      );
+
+      // THEN it is refused and the credential survives
+      expect(result.result).toBe("error");
+      expect(result.code).toBe("IN_USE_CHECK_UNAVAILABLE");
+      expect(result.error).toContain("--force");
+      expect(
+        await getSecureKeyAsync(credentialKey("guarded-provider", "api_key")),
+      ).toBe("keep-me");
+    });
+
+    test("deletes directly when the caller forces past the unavailable guard", async () => {
+      /**
+       * An explicit --force still works with the daemon down.
+       */
+
+      // GIVEN a stored credential and no reachable daemon
+      _ipcResponse = {
+        ok: false,
+        error: "Could not connect to assistant daemon. Is it running?",
+      };
+      await setSecureKeyViaDaemon("api_key", "forced-provider", "drop-me");
+
+      // WHEN the delete is forced
+      const result = await deleteSecureKeyViaDaemon(
+        "api_key",
+        "forced-provider",
+        true,
+      );
+
+      // THEN the credential is gone from secure storage
+      expect(result.result).toBe("deleted");
+      expect(
+        await getSecureKeyAsync(credentialKey("forced-provider", "api_key")),
+      ).toBeUndefined();
+    });
+
     test("returns not-found for 404 errors", async () => {
       _ipcResponse = {
         ok: false,
@@ -167,5 +221,39 @@ describe("daemon credential client", () => {
         body: { type: "credential", name: "github-app:pem" },
       });
     });
+
+    test("delete carries the caller's force choice past the in-use guard", async () => {
+      // GIVEN a daemon that accepts the delete
+      _ipcResponse = { ok: true, result: { success: true } };
+      _lastIpcCall = null;
+
+      // WHEN the caller forces the delete
+      await deleteSecureKeyViaDaemon("api_key", "agentrouter", true);
+
+      // THEN `force` rides along in the request body
+      const captured = _lastIpcCall as {
+        method: string;
+        params: unknown;
+      } | null;
+      expect(captured?.params).toEqual({
+        body: { type: "api_key", name: "agentrouter", force: true },
+      });
+    });
+
+    test("delete surfaces the in-use refusal from the daemon", async () => {
+      // GIVEN a credential an LLM provider connection resolves its auth through
+      _ipcResponse = {
+        ok: false,
+        error:
+          'Credential credential/agentrouter/api_key is in use by connection "agentrouter". It will stop working without it. Delete it anyway to continue.',
+      };
+
+      // WHEN the delete is attempted without force
+      const result = await deleteSecureKeyViaDaemon("api_key", "agentrouter");
+
+      // THEN the refusal reaches the caller naming the dependent connection
+      expect(result.result).toBe("error");
+      expect(result.error).toContain('in use by connection "agentrouter"');
+    });
   });
 });

package/src/__tests__/default-plugin-names-guard.test.ts

@@ -1,7 +1,10 @@
 import { describe, expect, test } from "bun:test";
 
 import { getAllDefaultPlugins } from "../plugins/defaults/index.js";
-import { getAllDefaultPluginNames } from "../plugins/defaults/main.js";
+import {
+  getAllDefaultPluginNames,
+  isFirstPartyDefaultPlugin,
+} from "../plugins/defaults/main.js";
 
 /**
  * Guard: the filesystem-backed default-plugin registry (`defaults/main.ts`)
@@ -25,4 +28,12 @@ describe("default plugin names", () => {
       expect(name).toMatch(/^default-[a-z0-9-]+$/);
     }
   });
+
+  test("isFirstPartyDefaultPlugin matches the filesystem registry and rejects other names", () => {
+    for (const name of getAllDefaultPluginNames()) {
+      expect(isFirstPartyDefaultPlugin(name)).toBe(true);
+    }
+    expect(isFirstPartyDefaultPlugin("default-a")).toBe(false);
+    expect(isFirstPartyDefaultPlugin("uplug-a")).toBe(false);
+  });
 });

package/src/__tests__/dm-backfill.test.ts

@@ -180,6 +180,8 @@ function readPersistedSlackRows(): Array<{
   provenanceSourceChannel: string | undefined;
   provenanceGuardianExternalUserId: string | undefined;
   provenanceRequesterIdentifier: string | undefined;
+  sentAt: number | undefined;
+  createdAt: number;
 }> {
   const db = getDb();
   return db
@@ -187,6 +189,7 @@ function readPersistedSlackRows(): Array<{
       role: messages.role,
       content: messages.content,
       metadata: messages.metadata,
+      createdAt: messages.createdAt,
     })
     .from(messages)
     .all()
@@ -231,6 +234,9 @@ function readPersistedSlackRows(): Array<{
           typeof envelope.provenanceRequesterIdentifier === "string"
             ? envelope.provenanceRequesterIdentifier
             : undefined,
+        sentAt:
+          typeof envelope.sentAt === "number" ? envelope.sentAt : undefined,
+        createdAt: row.createdAt,
       };
     });
 }
@@ -587,4 +593,61 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     const texts = rows.map((r) => r.content).sort();
     expect(texts).toEqual(["older A", "older B", "older D"]);
   });
+
+  test("backfilled rows carry the original send time as sentAt", async () => {
+    // History serialization prefers `sentAt` for the display timestamp, so a
+    // row without it reads as having arrived when the import ran.
+    const sentAt = Date.UTC(2026, 6, 8, 9, 15);
+    backfillDmMock.mockImplementation(async () => [
+      makeBackfilledMessage({
+        id: String(sentAt / 1000),
+        text: "six weeks old",
+        timestamp: sentAt,
+      }),
+    ]);
+
+    await handleChannelInbound(
+      buildDmRequest("live new DM"),
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
+
+    const [row] = readPersistedSlackRows();
+    expect(row).toBeDefined();
+    expect(row.sentAt).toBe(sentAt);
+    // The row is still written now; only the reported send time is historical.
+    // Asserting the gap is what proves `sentAt` is not just echoing createdAt.
+    expect(row.createdAt).toBeGreaterThan(sentAt);
+  });
+
+  test("backfill refuses history rows carrying a secret, keeping the rest", async () => {
+    const leakedKey = "AKIA3H7QWERTY9MNBVC2";
+    backfillDmMock.mockImplementation(async () => [
+      makeBackfilledMessage({
+        id: "1700000000.000001",
+        text: "ordinary older chatter",
+      }),
+      makeBackfilledMessage({
+        id: "1700000000.000002",
+        text: `here is the access key ${leakedKey} for the deploy`,
+      }),
+    ]);
+
+    await handleChannelInbound(
+      buildDmRequest("live new DM"),
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
+
+    const rows = readPersistedSlackRows();
+    expect(rows.map((r) => r.content)).toEqual(["ordinary older chatter"]);
+    // `rawContent`, not `content`: the latter is unwrapped by the test
+    // helper, so only the raw column proves what reached storage.
+    for (const row of rows) {
+      expect(row.rawContent).not.toContain(leakedKey);
+    }
+    expect(
+      rows.some((r) => r.slackMeta?.channelTs === "1700000000.000002"),
+    ).toBe(false);
+  });
 });

package/src/__tests__/dynamic-skill-background-guard.test.ts

@@ -65,9 +65,7 @@ mock.module("../permissions/checker.js", () => ({
   isDynamicSkillLoadInvocation: () => dynamicSkillLoad,
   classifyRisk: async () => ({ level: "medium" }),
   check: async () => ({ decision: checkDecision, reason: "medium risk" }),
-  generateAllowlistOptions: () => [],
   generateScopeOptions: () => [],
-  getCachedAssessment: () => undefined,
 }));
 
 mock.module("../telemetry/tool-usage-store.js", () => ({