@vellumai/assistant 0.11.6 → 0.11.7-staging.1

package/src/__tests__/mcp-cli.test.ts

@@ -438,7 +438,7 @@ describe("assistant mcp add", () => {
     expect(stderr).toContain("--url is required");
   });
 
-  test("defaults risk to high", async () => {
+  test("sends no risk when --risk is omitted, leaving the config default", async () => {
     const { exitCode } = await runMcpAdd("default-risk", [
       "-t",
       "sse",
@@ -447,6 +447,28 @@ describe("assistant mcp add", () => {
     ]);
     expect(exitCode).toBe(0);
 
+    const addCall = mockCliIpcCallFn.mock.calls.find(
+      (c) => c[0] === "internal_mcp_add",
+    );
+    expect(addCall).toBeDefined();
+    const body = (addCall![1] as Record<string, unknown>).body as Record<
+      string,
+      unknown
+    >;
+    expect(body.risk).toBeUndefined();
+  });
+
+  test("forwards an explicit --risk", async () => {
+    const { exitCode } = await runMcpAdd("explicit-risk", [
+      "-t",
+      "sse",
+      "-u",
+      "https://example.com/sse",
+      "-r",
+      "high",
+    ]);
+    expect(exitCode).toBe(0);
+
     const addCall = mockCliIpcCallFn.mock.calls.find(
       (c) => c[0] === "internal_mcp_add",
     );

package/src/__tests__/mcp-tool-annotations-risk.test.ts

@@ -40,60 +40,69 @@ function serverConfig(defaultRiskLevel: ServerRisk) {
   };
 }
 
-function toolWithAnnotations(readOnlyHint?: boolean) {
+interface RiskAnnotations {
+  readOnlyHint?: boolean;
+  destructiveHint?: boolean;
+}
+
+function toolWithAnnotations(annotations?: RiskAnnotations) {
   return {
     name: "get-summary",
     description: "Read a summary",
     inputSchema: { type: "object", properties: {} },
-    ...(readOnlyHint === undefined ? {} : { annotations: { readOnlyHint } }),
+    ...(annotations === undefined ? {} : { annotations }),
   };
 }
 
-describe("MCP tool risk from readOnlyHint annotations", () => {
+describe("MCP tool risk from annotations", () => {
   const fakeManager = { callTool: jest.fn() } as never;
 
-  test("readOnlyHint true on a medium-risk server lowers risk to Low", () => {
-    const tool = createMcpTool(
-      toolWithAnnotations(true),
-      "fathom",
-      serverConfig("medium"),
+  function riskFor(server: ServerRisk, annotations?: RiskAnnotations) {
+    return createMcpTool(
+      toolWithAnnotations(annotations),
+      "server",
+      serverConfig(server),
       fakeManager,
-    );
+    ).defaultRiskLevel;
+  }
 
-    expect(tool.defaultRiskLevel).toBe(RiskLevel.Low);
+  test("no annotations keeps the server level", () => {
+    expect(riskFor("low")).toBe(RiskLevel.Low);
+    expect(riskFor("medium")).toBe(RiskLevel.Medium);
+    expect(riskFor("high")).toBe(RiskLevel.High);
   });
 
-  test("readOnlyHint true on a high-risk server leaves risk at High", () => {
-    const tool = createMcpTool(
-      toolWithAnnotations(true),
-      "untrusted",
-      serverConfig("high"),
-      fakeManager,
-    );
+  test("readOnlyHint steps down from the medium default", () => {
+    expect(riskFor("medium", { readOnlyHint: true })).toBe(RiskLevel.Low);
+  });
 
-    expect(tool.defaultRiskLevel).toBe(RiskLevel.High);
+  test("readOnlyHint cannot lower a server the user pinned to high", () => {
+    expect(riskFor("high", { readOnlyHint: true })).toBe(RiskLevel.High);
   });
 
-  test("missing annotations keeps the server default risk", () => {
-    const tool = createMcpTool(
-      toolWithAnnotations(undefined),
-      "fathom",
-      serverConfig("medium"),
-      fakeManager,
-    );
+  test("readOnlyHint cannot step below low", () => {
+    expect(riskFor("low", { readOnlyHint: true })).toBe(RiskLevel.Low);
+  });
 
-    expect(tool.defaultRiskLevel).toBe(RiskLevel.Medium);
+  test("destructiveHint steps up one level", () => {
+    expect(riskFor("low", { destructiveHint: true })).toBe(RiskLevel.Medium);
+    expect(riskFor("medium", { destructiveHint: true })).toBe(RiskLevel.High);
   });
 
-  test("readOnlyHint false on a low-risk server keeps risk at Low", () => {
-    const tool = createMcpTool(
-      toolWithAnnotations(false),
-      "trusted",
-      serverConfig("low"),
-      fakeManager,
-    );
+  test("destructiveHint cannot step above high", () => {
+    expect(riskFor("high", { destructiveHint: true })).toBe(RiskLevel.High);
+  });
+
+  test("destructiveHint wins when a server sends both", () => {
+    expect(
+      riskFor("medium", { readOnlyHint: true, destructiveHint: true }),
+    ).toBe(RiskLevel.High);
+  });
 
-    expect(tool.defaultRiskLevel).toBe(RiskLevel.Low);
+  test("hints set to false leave the server level alone", () => {
+    expect(
+      riskFor("medium", { readOnlyHint: false, destructiveHint: false }),
+    ).toBe(RiskLevel.Medium);
   });
 });
 

package/src/__tests__/media-stream-stt-session.test.ts

@@ -774,6 +774,7 @@ describe("MediaStreamSttSession", () => {
 
       expect(resolveStreamingTranscriber).toHaveBeenCalledTimes(1);
       expect(resolveStreamingTranscriber).toHaveBeenCalledWith({
+        role: "telephony",
         sampleRate: 16_000,
         utteranceBoundaryFinals: true,
         utteranceEndMs: 1000,
@@ -787,6 +788,7 @@ describe("MediaStreamSttSession", () => {
       const { session } = await startStreamingSession();
 
       expect(resolveStreamingTranscriber).toHaveBeenCalledWith({
+        role: "telephony",
         sampleRate: 16_000,
         utteranceBoundaryFinals: true,
         utteranceEndMs: 2500,

package/src/__tests__/notification-decision-fallback.test.ts

@@ -629,3 +629,109 @@ describe("access-request instruction enforcement", () => {
     expect(decision.renderedCopy.vellum?.body).not.toContain("reject");
   });
 });
+
+/**
+ * A question is the one payload whose copy cannot be composed: the guardian is
+ * choosing between the words it carries. The engine replaces title / body /
+ * deliveryText wholesale with the model's version, which is how a question
+ * reached a channel as a summary of itself with its options missing.
+ */
+describe("ask_question copy is pinned to the question", () => {
+  const askQuestionSignal = (): NotificationSignal => ({
+    signalId: "sig-ask-question-1",
+    createdAt: Date.now(),
+    sourceChannel: "slack",
+    sourceContextId: "conv-1",
+    sourceEventName: "guardian.question",
+    contextPayload: {
+      requestId: "req-ask-1",
+      requestCode: "08B619",
+      requestKind: "pending_question",
+      questionText: "What should I dig into?",
+      options: [
+        { id: "opt-thread", label: "This Slack thread" },
+        { id: "opt-pr", label: "The pull request" },
+      ],
+    },
+    attentionHints: {
+      requiresAction: true,
+      urgency: "high",
+      isAsyncBackground: false,
+      visibleInSourceNow: false,
+    },
+  });
+
+  beforeEach(() => {
+    configuredProvider = { sendMessage: async () => ({ content: [] }) };
+    // The tool-use envelope `classifyWithLLM` reads, not the decision fields
+    // alone: it takes `toolBlock.input`, and the field names inside must be
+    // the ones `validateDecisionOutput` requires. Either mismatch drops the
+    // decision to the fallback path, where this suite's own copy is correct
+    // and the pin under test never runs.
+    extractedToolUse = {
+      name: "record_notification_decision",
+      input: {
+        shouldNotify: true,
+        selectedChannels: ["slack"],
+        reasoningSummary: "guardian needs to answer",
+        dedupeKey: "ask-question-req-ask-1",
+        confidence: 0.9,
+        renderedCopy: {
+          slack: {
+            title: "Guardian question",
+            body: "Guardian wants to know where to focus",
+            deliveryText: "Guardian wants to know where to focus",
+          },
+        },
+      },
+    };
+  });
+
+  test("the composed paraphrase does not replace the question", async () => {
+    const decision = await evaluateSignal(askQuestionSignal(), [
+      "slack",
+    ] as NotificationChannel[]);
+
+    // Guards the fixture itself: a shape the validator rejects would fall
+    // back, and the assertions below would then be testing the fallback copy
+    // rather than the pin that overrides a composed paraphrase.
+    expect(decision.fallbackUsed).toBe(false);
+
+    const copy = decision.renderedCopy.slack;
+    // `deliveryText` is what the Slack adapter sends, ahead of body and title.
+    expect(copy?.deliveryText).toContain("What should I dig into?");
+    expect(copy?.deliveryText).not.toContain("wants to know where to focus");
+    expect(copy?.body).toContain("What should I dig into?");
+  });
+
+  test("the options ride along, numbered as the resolver orders them", async () => {
+    const decision = await evaluateSignal(askQuestionSignal(), [
+      "slack",
+    ] as NotificationChannel[]);
+
+    expect(decision.fallbackUsed).toBe(false);
+    const delivered = decision.renderedCopy.slack?.deliveryText ?? "";
+    expect(delivered).toContain("1. This Slack thread");
+    expect(delivered).toContain("2. The pull request");
+    expect(delivered).toContain("08B619");
+  });
+
+  test("a voice tool approval keeps its composed copy", async () => {
+    const signal = askQuestionSignal();
+    // A `pending_question` carrying a tool name is an approval, not a
+    // question, so composing its copy is correct.
+    signal.contextPayload = {
+      ...signal.contextPayload,
+      toolName: "bash",
+      options: undefined,
+    };
+    const decision = await evaluateSignal(signal, [
+      "slack",
+    ] as NotificationChannel[]);
+
+    expect(decision.fallbackUsed).toBe(false);
+    expect(decision.renderedCopy.slack?.deliveryText).toBe(
+      "Guardian wants to know where to focus",
+    );
+  });
+});

package/src/__tests__/notification-discord-adapter.test.ts

@@ -0,0 +1,162 @@
+/**
+ * DiscordAdapter delivery behavior.
+ *
+ * The invariant under test: the adapter addresses the *person*. Every send
+ * and update resolves the DM channel from the guardian's user snowflake at
+ * call time, so a room id stored anywhere can never become a delivery
+ * target, and approval notifications carry the typed-command instructions
+ * because nothing ingests component presses yet.
+ */
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+const dmOpens: string[] = [];
+const sendCalls: Array<{ channelId: string; text: string }> = [];
+const editCalls: Array<{ channelId: string; messageId: string; text: string }> =
+  [];
+
+mock.module("../messaging/providers/discord/api.js", () => ({
+  openDiscordDmChannel: async (userId: string) => {
+    dmOpens.push(userId);
+    return `dm-for-${userId}`;
+  },
+}));
+
+mock.module("../messaging/providers/discord/send.js", () => ({
+  sendDiscordReply: async (target: { channelId: string }, text: string) => {
+    sendCalls.push({ channelId: target.channelId, text });
+    return { lastMessageId: String(2000 + sendCalls.length) };
+  },
+  editDiscordMessage: async (
+    target: { channelId: string },
+    messageId: string,
+    text: string,
+  ) => {
+    editCalls.push({ channelId: target.channelId, messageId, text });
+  },
+}));
+
+import type {
+  ChannelDeliveryPayload,
+  ChannelDestination,
+} from "../notifications/types.js";
+
+const { DiscordAdapter } = await import("../notifications/adapters/discord.js");
+
+const GUARDIAN_USER_ID = "111222333444555666";
+
+function makePayload(
+  overrides?: Partial<ChannelDeliveryPayload>,
+): ChannelDeliveryPayload {
+  return {
+    sourceEventName: "schedule.notify",
+    copy: {
+      title: "Heads up",
+      body: "Your task finished.",
+    },
+    urgency: "medium",
+    ...overrides,
+  };
+}
+
+function makeDestination(
+  overrides?: Partial<ChannelDestination>,
+): ChannelDestination {
+  return {
+    channel: "discord",
+    endpoint: GUARDIAN_USER_ID,
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  dmOpens.length = 0;
+  sendCalls.length = 0;
+  editCalls.length = 0;
+});
+
+describe("DiscordAdapter.send", () => {
+  test("resolves the DM channel from the guardian's user snowflake", async () => {
+    const adapter = new DiscordAdapter();
+    const result = await adapter.send(makePayload(), makeDestination());
+
+    expect(result.success).toBe(true);
+    expect(result.messageId).toBe("2001");
+    expect(dmOpens).toEqual([GUARDIAN_USER_ID]);
+    expect(sendCalls).toHaveLength(1);
+    expect(sendCalls[0].channelId).toBe(`dm-for-${GUARDIAN_USER_ID}`);
+    expect(sendCalls[0].text).toContain("Your task finished.");
+  });
+
+  test("approval notifications carry the typed-command instructions", async () => {
+    const adapter = new DiscordAdapter();
+    const result = await adapter.send(
+      makePayload({
+        approvalContext: {
+          requestId: "req-1",
+          actions: [{ id: "approve_once", label: "Approve once" }],
+          plainTextFallback: 'Reply "approve" or "reject" to decide.',
+        },
+      }),
+      makeDestination(),
+    );
+
+    expect(result.success).toBe(true);
+    expect(sendCalls).toHaveLength(1);
+    expect(sendCalls[0].text).toContain(
+      'Reply "approve" or "reject" to decide.',
+    );
+  });
+
+  test("a destination without a guardian user id fails without calling the API", async () => {
+    const adapter = new DiscordAdapter();
+    const result = await adapter.send(
+      makePayload(),
+      makeDestination({ endpoint: undefined }),
+    );
+
+    expect(result.success).toBe(false);
+    expect(dmOpens).toHaveLength(0);
+    expect(sendCalls).toHaveLength(0);
+  });
+});
+
+describe("DiscordAdapter.update", () => {
+  test("edits the card through the same person-resolved DM channel", async () => {
+    const adapter = new DiscordAdapter();
+    const result = await adapter.update(
+      {
+        deliveryId: "delivery-1",
+        destination: GUARDIAN_USER_ID,
+        messageId: "2001",
+      },
+      { body: "This approval request has been resolved." },
+    );
+
+    expect(result.success).toBe(true);
+    expect(result.messageId).toBe("2001");
+    expect(dmOpens).toEqual([GUARDIAN_USER_ID]);
+    expect(editCalls).toEqual([
+      {
+        channelId: `dm-for-${GUARDIAN_USER_ID}`,
+        messageId: "2001",
+        text: "This approval request has been resolved.",
+      },
+    ]);
+  });
+
+  test("a delivery row without a captured message id cannot be updated", async () => {
+    const adapter = new DiscordAdapter();
+    const result = await adapter.update(
+      {
+        deliveryId: "delivery-2",
+        destination: GUARDIAN_USER_ID,
+        messageId: null,
+      },
+      { body: "resolved" },
+    );
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain("missing_message_id");
+    expect(editCalls).toHaveLength(0);
+  });
+});

package/src/__tests__/persist-unsendable-image-downscale.test.ts

@@ -2,18 +2,16 @@
  * Regression test for the durable-downscale path of the image-too-large
  * recovery (JARVIS-1041 review follow-up).
  *
- * When an oversized stored image *can* be shrunk on this host (the common macOS
- * path where `sips` is available), `persistUnsendableImageDowngrades` must write
- * the downscaled bytes back to the DB — not leave the original in place. The
+ * When an oversized stored image can be shrunk,
+ * `persistUnsendableImageDowngrades` must write the downscaled bytes back to
+ * the DB, not leave the original in place. The
  * latest tool-result media is intentionally kept in context, so leaving the
  * full-size block would rehydrate and re-reject on every later turn instead of
  * durably self-healing the conversation.
  *
- * `optimizeImageForTransport` needs `sips` and a decodable image to actually
- * downscale, which is not portable to CI, so it is mocked here to simulate a
- * successful shrink. The mock is process-global, so this case lives in its own
- * file (the test runner isolates each file in its own process) to avoid
- * disturbing the no-op-resize cases in persist-unsendable-image.test.ts.
+ * The encoder is mocked here to isolate the durable persistence behavior from
+ * image decoding. The mock is process-global, so this case lives in its own
+ * file to avoid disturbing the no-op resize cases.
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";

package/src/__tests__/persist-unsendable-image.test.ts

@@ -43,9 +43,9 @@ function resetTables(): void {
 /**
  * Build a minimal PNG whose IHDR declares the given dimensions. Only the
  * 8-byte signature and the width/height fields (read by `parseImageDimensions`)
- * need to be correct; the rest is padding. `optimizeImageForTransport` cannot
- * downscale this off macOS (no `sips`), so it stays a no-op — exactly the
- * host condition that produces an unsendable stored image.
+ * need to be correct; the rest is padding. The image is not decodable, so
+ * `optimizeImageForTransport` leaves it unchanged and produces the unsendable
+ * stored-image condition.
  */
 function makePngBase64(width: number, height: number, padBytes = 0): string {
   const header = Buffer.from(

package/src/__tests__/platform.test.ts

@@ -1,10 +1,11 @@
 import { existsSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import { join } from "node:path";
+import { join, win32 } from "node:path";
 import { afterAll, afterEach, describe, expect, test } from "bun:test";
 
 import {
   ensureDataDir,
+  formatHomeRelativePath,
   getDataDir,
   getDbPath,
   getHistoryPath,
@@ -64,6 +65,23 @@ afterEach(() => {
 // Workspace helpers resolve under VELLUM_WORKSPACE_DIR when set,
 // otherwise under ~/.vellum/workspace.
 describe("path characterization", () => {
+  test("formats Windows workspace paths relative to the home directory", () => {
+    expect(
+      formatHomeRelativePath(
+        "C:\\Users\\Alice\\.vellum\\workspace",
+        "C:\\Users\\Alice",
+        win32,
+      ),
+    ).toBe("~\\.vellum\\workspace");
+    expect(
+      formatHomeRelativePath(
+        "D:\\Vellum\\workspace",
+        "C:\\Users\\Alice",
+        win32,
+      ),
+    ).toBe("D:\\Vellum\\workspace");
+  });
+
   test("all path helpers resolve to expected locations", () => {
     // Without VELLUM_WORKSPACE_DIR override, workspace is under ~/.vellum
     delete process.env.VELLUM_WORKSPACE_DIR;

package/src/__tests__/plugin-import-boundary-guard.test.ts

@@ -128,7 +128,7 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../../daemon/embedding-reconcile.js",
     "../../../../daemon/trust-context.js",
     "../../../../daemon/turn-latency-sub-spans.js",
-    "../../../../notifications/emit-signal.js",
+    "../../../../notifications/background-failure-signal.js",
     "../../../../persistence/checkpoints.js",
     "../../../../persistence/conversation-types.js",
     "../../../../persistence/db-connection.js",
@@ -173,6 +173,10 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../context/strip-injections.js",
     "../../../context/token-estimator.js",
     "../../../conversations/job-handlers/summarization.js",
+    // The standalone memory worker hosts real agent conversations, so its
+    // entry point starts the same eviction sweep the daemon starts at
+    // startup. No plugin-api equivalent.
+    "../../../daemon/conversation-evictor.js",
     "../../../daemon/date-context.js",
     "../../../daemon/disk-pressure-background-gate.js",
     "../../../daemon/embedding-reconcile.js",

package/src/__tests__/provider-usage-tracking.test.ts

@@ -164,6 +164,62 @@ describe("UsageTrackingProvider", () => {
     });
   });
 
+  test("attributes a fallback-served response to the stamped backup profile", async () => {
+    // RetryProvider's fallback escalation stamps `actualProvider` and
+    // `actualInferenceProfile` on the response it serves from the backup
+    // route. The usage event must follow those stamps, not the original
+    // request options, which still carry the failed primary's resolution.
+    setLlmConfig({
+      profiles: {
+        balanced: {
+          provider: "openai",
+          model: "gpt-5.4-mini",
+        },
+        "backup-profile": {
+          provider: "anthropic",
+          model: "claude-sonnet-4-5",
+        },
+      },
+      activeProfile: "balanced",
+      callSites: {
+        conversationTitle: { profile: "balanced" },
+      },
+      pricingOverrides: [],
+    });
+
+    const provider = new UsageTrackingProvider(
+      makeProvider({
+        content: [{ type: "text", text: "Title" }],
+        model: "claude-sonnet-4-5",
+        actualProvider: "anthropic",
+        actualInferenceProfile: "backup-profile",
+        usage: {
+          inputTokens: 1_000,
+          outputTokens: 2_000,
+        },
+        stopReason: "end_turn",
+      }),
+    );
+
+    await provider.sendMessage(
+      [{ role: "user", content: [{ type: "text", text: "Summarize" }] }],
+      {
+        config: {
+          callSite: "conversationTitle",
+        },
+      },
+    );
+
+    const events = listUsageEvents();
+    expect(events).toHaveLength(1);
+    expect(events[0]).toMatchObject({
+      provider: "anthropic",
+      model: "claude-sonnet-4-5",
+      callSite: "conversationTitle",
+      inferenceProfile: "backup-profile",
+    });
+  });
+
   test("does not record calls without a call site", async () => {
     const provider = new UsageTrackingProvider(
       makeProvider({

package/src/__tests__/require-fresh-approval.test.ts

@@ -34,14 +34,17 @@ const auditCalls = {
   denied: [] as any[],
   error: [] as any[],
   executed: [] as any[],
-  prompted: [] as string[],
+  prompted: [] as any[],
+  decided: [] as any[],
 };
 
 mock.module("../telemetry/tool-audit.js", () => ({
   recordToolDenied: (e: any) => auditCalls.denied.push(e),
   recordToolError: (e: any) => auditCalls.error.push(e),
   recordToolExecuted: (e: any) => auditCalls.executed.push(e),
-  recordToolPermissionPrompted: (n: string) => auditCalls.prompted.push(n),
+  recordToolPermissionPrompted: (e: any) => auditCalls.prompted.push(e),
+  recordToolPermissionDecided: (e: any, outcome: string) =>
+    auditCalls.decided.push({ entry: e, outcome }),
 }));
 
 // ---------------------------------------------------------------------------