@vellumai/assistant 0.11.5 → 0.11.6-staging.1

package/src/__tests__/notification-telegram-adapter.test.ts

@@ -13,6 +13,15 @@ const sendCalls: Array<{
 /** When true, sendTelegramReply throws if an approval argument is present. */
 let rejectRichDelivery = false;
 
+const editCalls: Array<{
+  chatId: string;
+  messageId: string;
+  text: string;
+}> = [];
+
+/** When set, editTelegramMessage rejects with this message. */
+let editFailure: string | undefined;
+
 mock.module("../messaging/providers/telegram-bot/send.js", () => ({
   sendTelegramReply: async (
     chatId: string,
@@ -37,6 +46,16 @@ mock.module("../messaging/providers/telegram-bot/send.js", () => ({
     totalCount: 0,
   }),
   sendTelegramTypingIndicator: async () => true,
+  editTelegramMessage: async (
+    chatId: string,
+    messageId: string,
+    text: string,
+  ) => {
+    if (editFailure) {
+      throw new Error(editFailure);
+    }
+    editCalls.push({ chatId, messageId, text });
+  },
 }));
 
 import { TelegramAdapter } from "../notifications/adapters/telegram.js";
@@ -72,7 +91,9 @@ function makeDestination(
 describe("TelegramAdapter", () => {
   beforeEach(() => {
     sendCalls.length = 0;
+    editCalls.length = 0;
     rejectRichDelivery = false;
+    editFailure = undefined;
   });
 
   test("prefers deliveryText and does not append deterministic label", async () => {
@@ -301,4 +322,85 @@ describe("TelegramAdapter", () => {
     );
     expect(call.text).toContain("XYZW");
   });
+
+  describe("update", () => {
+    test("edits the delivered message in place and keeps its id", async () => {
+      const adapter = new TelegramAdapter();
+
+      const result = await adapter.update(
+        {
+          deliveryId: "del-1",
+          destination: "chat-123",
+          messageId: "5150",
+          conversationId: null,
+        },
+        { body: "Approved by Alice" },
+      );
+
+      expect(result.success).toBe(true);
+      expect(editCalls).toEqual([
+        { chatId: "chat-123", messageId: "5150", text: "Approved by Alice" },
+      ]);
+      // An edit addresses one message and leaves it in place, so the delivery
+      // row's id must still identify the card afterwards.
+      expect(result.messageId).toBe("5150");
+      // Revising a card must never post a second one beside it.
+      expect(sendCalls).toHaveLength(0);
+    });
+
+    test("falls back to the title when no body is supplied", async () => {
+      const adapter = new TelegramAdapter();
+
+      await adapter.update(
+        {
+          deliveryId: "del-1",
+          destination: "chat-123",
+          messageId: "5150",
+          conversationId: null,
+        },
+        { title: "Expired" },
+      );
+
+      expect(editCalls[0]?.text).toBe("Expired");
+    });
+
+    test("refuses a delivery that captured no message id", async () => {
+      const adapter = new TelegramAdapter();
+
+      const result = await adapter.update(
+        {
+          deliveryId: "del-1",
+          destination: "chat-123",
+          messageId: null,
+          conversationId: null,
+        },
+        { body: "Approved" },
+      );
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("missing_message_id");
+      expect(editCalls).toHaveLength(0);
+    });
+
+    test("reports a failed edit rather than posting a replacement", async () => {
+      const adapter = new TelegramAdapter();
+      editFailure = "Telegram API error: message to edit not found";
+
+      const result = await adapter.update(
+        {
+          deliveryId: "del-1",
+          destination: "chat-123",
+          messageId: "5150",
+          conversationId: null,
+        },
+        { body: "Approved" },
+      );
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("message to edit not found");
+      // The original would otherwise sit beside the replacement, which reads
+      // as the assistant answering twice.
+      expect(sendCalls).toHaveLength(0);
+    });
+  });
 });

package/src/__tests__/oauth-commands-routes.test.ts

@@ -656,6 +656,95 @@ describe("POST oauth/request", () => {
     expect(result.body).toEqual({ hello: "world" });
   });
 
+  test("passes a pre-parsed string body through to the connection unchanged", async () => {
+    const multipart =
+      "--boundary\r\nContent-Type: application/json\r\n\r\n{}\r\n--boundary--\r\n";
+
+    await getRoute("POST", "oauth/request").handler(
+      makeArgs({
+        body: {
+          provider: "google",
+          url: "https://api.google.com/upload/drive/v3/files",
+          method: "POST",
+          headers: { "Content-Type": "multipart/related; boundary=boundary" },
+          parsed_data: multipart,
+        },
+      }),
+    );
+
+    expect(mockResolveRequests).toHaveLength(1);
+    const req = mockResolveRequests[0] as {
+      body: unknown;
+      headers: Record<string, string>;
+    };
+    expect(req.body).toBe(multipart);
+    expect(req.headers["Content-Type"]).toBe(
+      "multipart/related; boundary=boundary",
+    );
+  });
+
+  test("keeps a raw data string raw under a non-JSON Content-Type", async () => {
+    await getRoute("POST", "oauth/request").handler(
+      makeArgs({
+        body: {
+          provider: "google",
+          url: "https://api.google.com/upload/drive/v3/files",
+          method: "POST",
+          headers: { "content-type": "text/csv" },
+          data: '{"looks":"like json"}',
+        },
+      }),
+    );
+
+    const req = mockResolveRequests[0] as { body: unknown };
+    expect(req.body).toBe('{"looks":"like json"}');
+  });
+
+  test("parses a raw data string as JSON under a JSON Content-Type", async () => {
+    await getRoute("POST", "oauth/request").handler(
+      makeArgs({
+        body: {
+          provider: "google",
+          url: "https://api.google.com/v1/sheets",
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          data: '{"title":"Sheet"}',
+        },
+      }),
+    );
+
+    const req = mockResolveRequests[0] as { body: unknown };
+    expect(req.body).toEqual({ title: "Sheet" });
+  });
+
+  test("base64-encodes binary response bodies for the JSON envelope", async () => {
+    const binary = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0xff, 0x00]);
+    mockResolveResponse = {
+      status: 200,
+      headers: { "content-type": "application/octet-stream" },
+      body: binary,
+    };
+    const result = (await getRoute("POST", "oauth/request").handler(
+      makeArgs({
+        body: {
+          provider: "google",
+          url: "https://api.google.com/drive/v3/files/file-123?alt=media",
+        },
+      }),
+    )) as {
+      ok: boolean;
+      status: number;
+      body: unknown;
+      bodyEncoding?: string;
+    };
+    expect(result.ok).toBe(true);
+    expect(result.body).toBe(binary.toString("base64"));
+    expect(result.bodyEncoding).toBe("base64");
+    expect(Buffer.from(String(result.body), "base64").equals(binary)).toBe(
+      true,
+    );
+  });
+
   test("rejects absolute URL host outside provider base host when no injection templates exist", async () => {
     await expect(
       getRoute("POST", "oauth/request").handler(

package/src/__tests__/oauth-provider-profiles.test.ts

@@ -14,16 +14,15 @@ await initializeDb();
 seedOAuthProviders();
 
 describe("oauth provider profiles (DB-seeded)", () => {
-  test("google provider row includes Drive in default scopes", () => {
+  test("google provider row includes Drive, Sheets, and Slides in default scopes", () => {
     const provider = getProvider("google");
 
     expect(provider).toBeDefined();
-    expect(JSON.parse(provider!.defaultScopes)).toContain(
-      "https://www.googleapis.com/auth/drive",
-    );
+    const scopes = JSON.parse(provider!.defaultScopes) as string[];
+    expect(scopes).toContain("https://www.googleapis.com/auth/drive");
   });
 
-  test("google provider row contains bearer injection templates for 6 Google API hosts", () => {
+  test("google provider row contains bearer injection templates for 8 Google API hosts", () => {
     const provider = getProvider("google");
 
     expect(provider).toBeDefined();
@@ -36,7 +35,7 @@ describe("oauth provider profiles (DB-seeded)", () => {
       valuePrefix: string;
     }>;
 
-    expect(templates).toHaveLength(6);
+    expect(templates).toHaveLength(8);
 
     const byHost = new Map(templates.map((t) => [t.hostPattern, t]));
 
@@ -45,6 +44,8 @@ describe("oauth provider profiles (DB-seeded)", () => {
       "www.googleapis.com",
       "people.googleapis.com",
       "docs.googleapis.com",
+      "sheets.googleapis.com",
+      "slides.googleapis.com",
       "tasks.googleapis.com",
       "calendar.googleapis.com",
     ]) {

package/src/__tests__/openai-provider.test.ts

@@ -82,9 +82,27 @@ class FakeAPIError extends Error {
   }
 }
 
+// Simulate the SDK's transport-failure and caller-abort subclasses; the
+// error normalizer distinguishes them by class, so the mock must define both
+// for suites that share this process.
+class FakeAPIConnectionError extends FakeAPIError {
+  constructor() {
+    super(undefined as unknown as number, "Connection error.");
+    this.name = "APIConnectionError";
+  }
+}
+class FakeAPIUserAbortError extends FakeAPIError {
+  constructor() {
+    super(undefined as unknown as number, "Request was aborted.");
+    this.name = "APIUserAbortError";
+  }
+}
+
 mock.module("openai", () => ({
   default: class MockOpenAI {
     static APIError = FakeAPIError;
+    static APIConnectionError = FakeAPIConnectionError;
+    static APIUserAbortError = FakeAPIUserAbortError;
     constructor(opts: Record<string, unknown>) {
       lastConstructorOptions = opts;
     }

package/src/__tests__/openai-responses-provider.test.ts

@@ -50,9 +50,27 @@ class FakeAPIError extends Error {
   }
 }
 
+// Simulate the SDK's transport-failure and caller-abort subclasses; the
+// error normalizer distinguishes them by class, so the mock must define both
+// for suites that share this process.
+class FakeAPIConnectionError extends FakeAPIError {
+  constructor() {
+    super(undefined as unknown as number, "Connection error.");
+    this.name = "APIConnectionError";
+  }
+}
+class FakeAPIUserAbortError extends FakeAPIError {
+  constructor() {
+    super(undefined as unknown as number, "Request was aborted.");
+    this.name = "APIUserAbortError";
+  }
+}
+
 mock.module("openai", () => ({
   default: class MockOpenAI {
     static APIError = FakeAPIError;
+    static APIConnectionError = FakeAPIConnectionError;
+    static APIUserAbortError = FakeAPIUserAbortError;
     constructor(opts: Record<string, unknown>) {
       lastConstructorOptions = opts;
     }

package/src/__tests__/platform-callback-registration.test.ts

@@ -1,11 +1,14 @@
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { setIngressPublicBaseUrl } from "../config/env.js";
 import { credentialKey } from "../security/credential-key.js";
 
 let mockIsPlatform = true;
 let mockPlatformBaseUrl = "";
 let mockPlatformAssistantId = "";
 let mockSecureKeys: Record<string, string> = {};
+let mockConfig: { ingress?: { publicBaseUrl?: string; enabled?: boolean } } =
+  {};
 
 // Bun shares mocked modules across test files in a combined run, so each mock
 // spreads the real module and overrides only what this file drives. Replacing
@@ -30,6 +33,12 @@ mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: async (key: string) => mockSecureKeys[key] ?? undefined,
 }));
 
+const actualLoader = await import("../config/loader.js");
+mock.module("../config/loader.js", () => ({
+  ...actualLoader,
+  getConfig: () => mockConfig,
+}));
+
 const originalFetch = globalThis.fetch;
 const originalEnvCredential = process.env.ASSISTANT_API_KEY;
 
@@ -48,6 +57,8 @@ describe("platform callback registration", () => {
     mockPlatformBaseUrl = "";
     mockPlatformAssistantId = "";
     mockSecureKeys = {};
+    mockConfig = {};
+    setIngressPublicBaseUrl(undefined);
     delete process.env.ASSISTANT_API_KEY;
     globalThis.fetch = originalFetch;
   });
@@ -155,6 +166,177 @@ describe("platform callback registration", () => {
       registerCallbackRoute("webhooks/telegram", "telegram"),
     ).resolves.toBe("https://platform.example.com/v1/gateway/callbacks/x/");
   });
+
+  test("self-hosted registerCallbackRoute sends configured callback_base_url", async () => {
+    mockIsPlatform = false;
+    mockConfig = {
+      ingress: { publicBaseUrl: "https://my-assistant.example.com" },
+    };
+    mockSecureKeys[credentialKey("vellum", "platform_base_url")] =
+      "https://platform.example.com";
+    mockSecureKeys[credentialKey("vellum", "platform_assistant_id")] =
+      "22222222-3333-4444-8555-666666666666";
+    mockSecureKeys[credentialKey("vellum", "assistant_api_key")] =
+      "ast-self-hosted-key";
+
+    globalThis.fetch = mock(
+      async (_input: RequestInfo | URL, init?: RequestInit) => {
+        expect(JSON.parse(String(init?.body))).toEqual({
+          assistant_id: "22222222-3333-4444-8555-666666666666",
+          callback_path: "webhooks/telegram",
+          type: "telegram",
+          callback_base_url: "https://my-assistant.example.com",
+        });
+
+        return new Response(
+          JSON.stringify({
+            callback_url:
+              "https://my-assistant.example.com/v1/gateway/callbacks/x/",
+            callback_path:
+              "22222222-3333-4444-8555-666666666666/webhooks/telegram",
+            type: "telegram",
+            assistant_id: "22222222-3333-4444-8555-666666666666",
+          }),
+          {
+            status: 201,
+            headers: { "content-type": "application/json" },
+          },
+        );
+      },
+    ) as unknown as typeof fetch;
+
+    await expect(
+      registerCallbackRoute("webhooks/telegram", "telegram"),
+    ).resolves.toBe(
+      "https://my-assistant.example.com/v1/gateway/callbacks/x/",
+    );
+  });
+
+  test("self-hosted registerCallbackRoute sends detected module-level callback_base_url", async () => {
+    mockIsPlatform = false;
+    mockConfig = {};
+    setIngressPublicBaseUrl("https://detected.example.com/");
+    mockSecureKeys[credentialKey("vellum", "platform_base_url")] =
+      "https://platform.example.com";
+    mockSecureKeys[credentialKey("vellum", "platform_assistant_id")] =
+      "22222222-3333-4444-8555-666666666666";
+    mockSecureKeys[credentialKey("vellum", "assistant_api_key")] =
+      "ast-self-hosted-key";
+
+    globalThis.fetch = mock(
+      async (_input: RequestInfo | URL, init?: RequestInit) => {
+        expect(JSON.parse(String(init?.body))).toEqual({
+          assistant_id: "22222222-3333-4444-8555-666666666666",
+          callback_path: "webhooks/telegram",
+          type: "telegram",
+          callback_base_url: "https://detected.example.com",
+        });
+
+        return new Response(
+          JSON.stringify({
+            callback_url:
+              "https://detected.example.com/v1/gateway/callbacks/x/",
+            callback_path:
+              "22222222-3333-4444-8555-666666666666/webhooks/telegram",
+            type: "telegram",
+            assistant_id: "22222222-3333-4444-8555-666666666666",
+          }),
+          {
+            status: 201,
+            headers: { "content-type": "application/json" },
+          },
+        );
+      },
+    ) as unknown as typeof fetch;
+
+    await expect(
+      registerCallbackRoute("webhooks/telegram", "telegram"),
+    ).resolves.toBe("https://detected.example.com/v1/gateway/callbacks/x/");
+  });
+
+  test("self-hosted registerCallbackRoute omits callback_base_url when no ingress is available", async () => {
+    mockIsPlatform = false;
+    mockConfig = {};
+    mockSecureKeys[credentialKey("vellum", "platform_base_url")] =
+      "https://platform.example.com";
+    mockSecureKeys[credentialKey("vellum", "platform_assistant_id")] =
+      "22222222-3333-4444-8555-666666666666";
+    mockSecureKeys[credentialKey("vellum", "assistant_api_key")] =
+      "ast-self-hosted-key";
+
+    globalThis.fetch = mock(
+      async (_input: RequestInfo | URL, init?: RequestInit) => {
+        const body = JSON.parse(String(init?.body)) as Record<string, string>;
+        expect(body).toEqual({
+          assistant_id: "22222222-3333-4444-8555-666666666666",
+          callback_path: "webhooks/telegram",
+          type: "telegram",
+        });
+        expect(body).not.toHaveProperty("callback_base_url");
+
+        return new Response(
+          JSON.stringify({
+            callback_url:
+              "https://platform.example.com/v1/gateway/callbacks/x/",
+            callback_path:
+              "22222222-3333-4444-8555-666666666666/webhooks/telegram",
+            type: "telegram",
+            assistant_id: "22222222-3333-4444-8555-666666666666",
+          }),
+          {
+            status: 201,
+            headers: { "content-type": "application/json" },
+          },
+        );
+      },
+    ) as unknown as typeof fetch;
+
+    await expect(
+      registerCallbackRoute("webhooks/telegram", "telegram"),
+    ).resolves.toBe("https://platform.example.com/v1/gateway/callbacks/x/");
+  });
+
+  test("platform-managed registerCallbackRoute omits callback_base_url even when ingress exists", async () => {
+    mockIsPlatform = true;
+    mockConfig = { ingress: { publicBaseUrl: "https://velay.example.com" } };
+    mockSecureKeys[credentialKey("vellum", "platform_base_url")] =
+      "https://platform.example.com";
+    mockSecureKeys[credentialKey("vellum", "platform_assistant_id")] =
+      "11111111-2222-4333-8444-555555555555";
+    mockSecureKeys[credentialKey("vellum", "assistant_api_key")] =
+      "ast-managed-key";
+
+    globalThis.fetch = mock(
+      async (_input: RequestInfo | URL, init?: RequestInit) => {
+        const body = JSON.parse(String(init?.body)) as Record<string, string>;
+        expect(body).not.toHaveProperty("callback_base_url");
+        expect(body).toEqual({
+          assistant_id: "11111111-2222-4333-8444-555555555555",
+          callback_path: "webhooks/telegram",
+          type: "telegram",
+        });
+
+        return new Response(
+          JSON.stringify({
+            callback_url:
+              "https://platform.example.com/v1/gateway/callbacks/x/",
+            callback_path:
+              "11111111-2222-4333-8444-555555555555/webhooks/telegram",
+            type: "telegram",
+            assistant_id: "11111111-2222-4333-8444-555555555555",
+          }),
+          {
+            status: 201,
+            headers: { "content-type": "application/json" },
+          },
+        );
+      },
+    ) as unknown as typeof fetch;
+
+    await expect(
+      registerCallbackRoute("webhooks/telegram", "telegram"),
+    ).resolves.toBe("https://platform.example.com/v1/gateway/callbacks/x/");
+  });
 });
 
 /**
@@ -194,6 +376,8 @@ describe("resolveCallbackUrl resolution order", () => {
     mockPlatformBaseUrl = "";
     mockPlatformAssistantId = "";
     mockSecureKeys = {};
+    mockConfig = {};
+    setIngressPublicBaseUrl(undefined);
     delete process.env.ASSISTANT_API_KEY;
     registerCalls = 0;
     globalThis.fetch = mock(async () => {

package/src/__tests__/plugin-api-store-credential.test.ts

@@ -13,9 +13,14 @@ import {
 } from "bun:test";
 
 import { credentialKey } from "@vellumai/credential-storage";
+import { eq } from "drizzle-orm";
 
+import * as conversationStore from "../daemon/conversation-store.js";
 import * as scrub from "../daemon/credential-transcript-scrub.js";
 import * as manualToken from "../oauth/manual-token-connection.js";
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+import { providerConnections } from "../persistence/schema/inference.js";
 import { resolveCredential } from "../plugin-api/resolve-credential.js";
 import {
   CredentialStoreError,
@@ -54,6 +59,9 @@ let setSpy: ReturnType<typeof spyOn>;
 let getSpy: ReturnType<typeof spyOn>;
 let scrubSpy: ReturnType<typeof spyOn>;
 let syncSpy: ReturnType<typeof spyOn>;
+let evictSpy: ReturnType<typeof spyOn>;
+
+await initializeDb();
 
 beforeEach(() => {
   if (existsSync(TEST_DIR)) {
@@ -89,6 +97,14 @@ beforeEach(() => {
   syncSpy = spyOn(manualToken, "syncManualTokenConnection").mockImplementation(
     async () => {},
   );
+  evictSpy = spyOn(
+    conversationStore,
+    "evictConversationsForReload",
+  ).mockImplementation(() => {});
+  getDb()
+    .delete(providerConnections)
+    .where(eq(providerConnections.name, "openrouter-connection"))
+    .run();
 });
 
 afterEach(() => {
@@ -96,6 +112,7 @@ afterEach(() => {
   getSpy.mockRestore();
   scrubSpy.mockRestore();
   syncSpy.mockRestore();
+  evictSpy.mockRestore();
 });
 
 afterAll(() => {
@@ -198,14 +215,65 @@ describe("storeCredential", () => {
     expect(syncSpy).toHaveBeenCalledWith("acme");
   });
 
+  /**
+   * Verifies that storeCredentialValue refreshes providers for dependent connections.
+   */
+  test("refreshes providers when a stored credential backs a connection", async () => {
+    // GIVEN a provider connection references the credential being stored.
+    const now = Date.now();
+    getDb()
+      .insert(providerConnections)
+      .values({
+        name: "openrouter-connection",
+        provider: "openai",
+        auth: JSON.stringify({
+          type: "api_key",
+          credential: credentialKey("openrouter", "api_key"),
+        }),
+        createdAt: now,
+        updatedAt: now,
+      })
+      .run();
+
+    // AND the credential is non-managed.
+    // WHEN the credential is stored.
+    await storeCredentialValue({
+      service: "openrouter",
+      field: "api_key",
+      value: "openrouter-key",
+      skipTranscriptScrub: true,
+    });
+
+    // THEN the provider refresh runs once.
+    expect(evictSpy).toHaveBeenCalledTimes(1);
+  });
+
+  /**
+   * Verifies that storeCredentialValue skips refresh for an unused credential.
+   */
+  test("does not refresh providers when a stored credential backs no connection", async () => {
+    // GIVEN no provider connection references the credential being stored.
+    // AND the credential is non-managed.
+    // WHEN the credential is stored.
+    await storeCredentialValue({
+      service: "acme",
+      field: "api_key",
+      value: "acme-key",
+      skipTranscriptScrub: true,
+    });
+
+    // THEN the provider refresh does not run.
+    expect(evictSpy).toHaveBeenCalledTimes(0);
+  });
+
   describe("plugin scoping", () => {
     test("fails closed with no plugin in context", async () => {
       // A plugin's module body is evaluated outside any context. An unscoped
       // branch there would let top-level code overwrite the user's own
       // credentials, so the write is refused instead.
-      await expect(storeCredential("acme/api_key", "sk-secret")).rejects.toThrow(
-        /requires an active plugin execution context/,
-      );
+      await expect(
+        storeCredential("acme/api_key", "sk-secret"),
+      ).rejects.toThrow(/requires an active plugin execution context/);
       expect(setSpy).not.toHaveBeenCalled();
       expect(getCredentialMetadata("acme", "api_key")).toBeUndefined();
     });

package/src/__tests__/pricing.test.ts

@@ -834,8 +834,8 @@ describe("Anthropic models on OpenRouter", () => {
     });
 
     expect(result.pricingStatus).toBe("priced");
-    // 0.05M x $0.1 direct + 0.05M x $0.125 write + 0.05M x $0.01 read
-    expect(result.estimatedCostUsd).toBeCloseTo(0.005 + 0.00625 + 0.0005, 10);
+    // 0.05M x $0.2 direct + 0.05M x $0.25 write + 0.05M x $0.02 read
+    expect(result.estimatedCostUsd).toBeCloseTo(0.01 + 0.0125 + 0.001, 10);
   });
 
   test("returns unpriced for unknown non-Anthropic OpenRouter model", () => {