@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/__tests__/tool-approval-handler.test.ts

@@ -103,13 +103,16 @@ const auditCalls = {
   denied: [] as any[],
   error: [] as any[],
   executed: [] as any[],
-  prompted: [] as string[],
+  prompted: [] as any[],
+  decided: [] as any[],
 };
 mock.module("../telemetry/tool-audit.js", () => ({
   recordToolDenied: (e: any) => auditCalls.denied.push(e),
   recordToolError: (e: any) => auditCalls.error.push(e),
   recordToolExecuted: (e: any) => auditCalls.executed.push(e),
-  recordToolPermissionPrompted: (n: string) => auditCalls.prompted.push(n),
+  recordToolPermissionPrompted: (e: any) => auditCalls.prompted.push(e),
+  recordToolPermissionDecided: (e: any, outcome: string) =>
+    auditCalls.decided.push({ entry: e, outcome }),
 }));
 
 function resetAuditCalls(): void {
@@ -117,6 +120,7 @@ function resetAuditCalls(): void {
   auditCalls.error.length = 0;
   auditCalls.executed.length = 0;
   auditCalls.prompted.length = 0;
+  auditCalls.decided.length = 0;
 }
 
 import { mkdtempSync, rmSync } from "node:fs";
@@ -946,6 +950,8 @@ describe("ToolApprovalHandler / approval cell lifts the sensitive-tool floor", (
     }
 
     // Running code in the workspace is how you write everything else in it.
+    // A room cell cannot lift bash. A contact-level ceiling can; that path
+    // is covered in the contact-ceiling describe below.
     test("sandbox bash", async () => {
       await expectFloored("bash", { command: "ls" });
     });
@@ -1024,6 +1030,144 @@ describe("ToolApprovalHandler / approval cell lifts the sensitive-tool floor", (
     });
   });
 
+  describe("contact ceiling lifts sandbox bash", () => {
+    beforeEach(() => {
+      // A Full-access cell still cannot lift bash. These cases pass a
+      // contact ceiling so the lift comes from the person, not the room.
+      thresholdReaderMock.cell = cell("high");
+    });
+
+    test.each(["low", "medium", "high"] as const)(
+      "a %s contact ceiling lifts sandbox bash — no scoped grant required",
+      async (threshold) => {
+        thresholdReaderMock.contactThreshold = threshold;
+        const result = await handler.checkPreExecutionGates(
+          "bash",
+          { command: "ls" },
+          channelContext({ requesterContactId: "contact-1" }),
+          "low",
+          Date.now(),
+        );
+
+        expect(result.allowed).toBe(true);
+        if (!result.allowed) {
+          return;
+        }
+        expect(result.grantConsumed).toBeFalsy();
+        expect(auditCalls.denied.length).toBe(0);
+        // Contact ceiling is already on the turn; the cell is not consulted.
+        expect(thresholdReaderMock.cellLookups).toBe(0);
+      },
+    );
+
+    test("a none contact ceiling leaves sandbox bash on the floor", async () => {
+      thresholdReaderMock.contactThreshold = "none";
+      const result = await handler.checkPreExecutionGates(
+        "bash",
+        { command: "ls" },
+        channelContext({ requesterContactId: "contact-1" }),
+        "low",
+        Date.now(),
+      );
+
+      expect(result.allowed).toBe(false);
+      if (result.allowed) {
+        return;
+      }
+      expect(result.result.content).toContain("requires guardian approval");
+      expect(thresholdReaderMock.cellLookups).toBe(0);
+    });
+
+    test("an unset contact ceiling leaves sandbox bash on the floor", async () => {
+      const result = await handler.checkPreExecutionGates(
+        "bash",
+        { command: "ls" },
+        channelContext(),
+        "low",
+        Date.now(),
+      );
+
+      expect(result.allowed).toBe(false);
+      expect(thresholdReaderMock.cellLookups).toBe(0);
+    });
+
+    test("a high contact ceiling does not lift host_bash", async () => {
+      thresholdReaderMock.contactThreshold = "high";
+      const result = await handler.checkPreExecutionGates(
+        "host_bash",
+        { command: "ls" },
+        channelContext({ requesterContactId: "contact-1" }),
+        "low",
+        Date.now(),
+      );
+
+      expect(result.allowed).toBe(false);
+      if (result.allowed) {
+        return;
+      }
+      expect(result.result.content).toContain("requires guardian approval");
+      expect(thresholdReaderMock.cellLookups).toBe(0);
+    });
+
+    test("a high contact ceiling does not lift a control-plane write", async () => {
+      thresholdReaderMock.contactThreshold = "high";
+      const result = await handler.checkPreExecutionGates(
+        "file_write",
+        { path: "SOUL.md", content: "x" },
+        channelContext({ requesterContactId: "contact-1" }),
+        "low",
+        Date.now(),
+      );
+
+      expect(result.allowed).toBe(false);
+      if (result.allowed) {
+        return;
+      }
+      expect(result.result.content).toContain("requires guardian approval");
+      expect(thresholdReaderMock.cellLookups).toBe(0);
+    });
+
+    test("a high contact ceiling lifts an ordinary workspace write even when the cell is Strict", async () => {
+      thresholdReaderMock.cell = cell("none");
+      thresholdReaderMock.contactThreshold = "high";
+
+      const result = await handler.checkPreExecutionGates(
+        "file_write",
+        { path: "notes/todo.md", content: "x" },
+        channelContext({ requesterContactId: "contact-1" }),
+        "low",
+        Date.now(),
+      );
+
+      expect(result.allowed).toBe(true);
+      if (!result.allowed) {
+        return;
+      }
+      expect(result.grantConsumed).toBeFalsy();
+      expect(thresholdReaderMock.cellLookups).toBe(0);
+    });
+
+    test("a none contact ceiling leaves an ordinary workspace write on the floor even when the cell is Full access", async () => {
+      thresholdReaderMock.cell = cell("high");
+      thresholdReaderMock.contactThreshold = "none";
+
+      const result = await handler.checkPreExecutionGates(
+        "file_write",
+        { path: "notes/todo.md", content: "x" },
+        channelContext({ requesterContactId: "contact-1" }),
+        "low",
+        Date.now(),
+      );
+
+      expect(result.allowed).toBe(false);
+      if (result.allowed) {
+        return;
+      }
+      expect(result.result.content).toContain("requires guardian approval");
+      expect(thresholdReaderMock.cellLookups).toBe(0);
+    });
+  });
+
   test("a public web_fetch is still lifted", async () => {
     thresholdReaderMock.cell = cell("low");
 

package/src/__tests__/tool-approval-seed-content-blocks.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 
+import { buildApprovalNotificationBlocks } from "../notifications/adapters/slack.js";
 import type {
   ApprovalCardBlock,
   ApprovalCardFallbackBlock,
@@ -90,9 +91,11 @@ describe("buildToolApprovalSeedContentBlocks", () => {
     });
   });
 
-  test("returns null for pending_question without toolName", () => {
+  test("pending_question without toolName renders as a question, not an approval", () => {
     const payload = { ...voiceToolApprovalPayload, toolName: undefined };
-    expect(buildToolApprovalSeedContentBlocks(payload)).toBeNull();
+    const surface = surfaceBlock(buildToolApprovalSeedContentBlocks(payload)!);
+    expect(surface.title).toBe("Question");
+    expect(surface.data.subtitle).toBe("Waiting on your answer");
   });
 
   test("produces a ui_surface block and a text fallback block for tool_approval", () => {
@@ -317,3 +320,106 @@ describe("buildToolApprovalSeedContentBlocks", () => {
     expect(fallback.text).toContain("Approve tool: bash (requested by Bob)");
   });
 });
+
+/**
+ * An `ask_question` prompt promoted to a guardian request. It renders as a
+ * question rather than an approval, and carries no buttons: the in-app surface
+ * route resolves approval actions only, so answering happens on the channel or
+ * by reply.
+ */
+describe("ask_question card", () => {
+  const questionPayload: Record<string, unknown> = {
+    requestId: "req-ask-321",
+    requestCode: "08B619",
+    requestKind: "pending_question",
+    questionText: "What should I dig into?",
+    sourceChannel: "slack",
+    options: [
+      { id: "opt-thread", label: "This Slack thread" },
+      { id: "opt-pr", label: "The pull request" },
+      { id: "opt-ticket", label: "The Linear ticket" },
+    ],
+  };
+
+  test("the question leads the card rather than generic guardian copy", () => {
+    const surface = surfaceBlock(
+      buildToolApprovalSeedContentBlocks(questionPayload)!,
+    );
+    expect(surface.title).toBe("Question");
+    expect(surface.data.title).toBe("What should I dig into?");
+  });
+
+  test("a question card offers no buttons, not even Approve and Reject", () => {
+    const surface = surfaceBlock(
+      buildToolApprovalSeedContentBlocks(questionPayload)!,
+    );
+    // Empty rather than absent: the builder reads an absent action set as a
+    // request for its generic Approve/Reject pair, which is the wrong verb for
+    // a question and would resolve as "Yes" or a skip if tapped. The answer
+    // options are not offered here either, because the in-app surface route
+    // resolves only approval actions, so they would be inert.
+    expect(surface.actions).toEqual([]);
+  });
+
+  test("a channel without buttons still gets the question and its options", () => {
+    const fallback = fallbackBlock(
+      buildToolApprovalSeedContentBlocks(questionPayload)!,
+    );
+    expect(fallback.text).toContain("What should I dig into?");
+    expect(fallback.text).toContain("1. This Slack thread");
+    expect(fallback.text).toContain("3. The Linear ticket");
+    expect(fallback.text).toContain("08B619");
+  });
+
+  test("a question with no options still offers no buttons", () => {
+    const payload = { ...questionPayload, options: undefined };
+    const surface = surfaceBlock(buildToolApprovalSeedContentBlocks(payload)!);
+    expect(surface.data.title).toBe("What should I dig into?");
+    expect(surface.actions).toEqual([]);
+  });
+});
+
+/**
+ * The Slack card heads itself from the approval's stated intent, so a question
+ * is not titled as an approval. Producers resolve the intent; the adapter only
+ * draws it.
+ */
+describe("Slack card intent", () => {
+  const base = {
+    sourceEventName: "guardian.question",
+    copy: { deliveryText: "What should I dig into?" },
+  };
+
+  test("a question card is headed Question", () => {
+    const blocks = buildApprovalNotificationBlocks(
+      {
+        ...base,
+        approvalContext: {
+          requestId: "req-ask-321",
+          actions: [{ id: "answer_0", label: "This Slack thread" }],
+          plainTextFallback: 'Reply "08B619 <your answer>".',
+          intent: "question",
+        },
+      } as never,
+      "What should I dig into?",
+    );
+    const card = blocks[0] as { title?: { text?: string } };
+    expect(card.title?.text).toBe("Question");
+  });
+
+  test("an approval with no tool details keeps its own heading", () => {
+    const blocks = buildApprovalNotificationBlocks(
+      {
+        ...base,
+        approvalContext: {
+          requestId: "req-appr-1",
+          actions: [{ id: "approve_once", label: "Approve" }],
+          plainTextFallback: 'Reply "ABC123 approve".',
+        },
+      } as never,
+      "Approve this",
+    );
+    const card = blocks[0] as { title?: { text?: string } };
+    expect(card.title?.text).toBe("Approval Request");
+  });
+});

package/src/__tests__/tool-audit.test.ts

@@ -8,10 +8,18 @@ mock.module("../platform/consent-cache.js", () => ({
   getRawShareAnalytics: () => shareAnalytics,
 }));
 
-// Capture the audit rows the terminals would insert, and the lifecycle-event
-// telemetry strings they would record, without touching the database.
+// Capture the audit rows the terminals would insert, and the lifecycle events
+// they would record, without touching the database.
 const records: Array<Record<string, unknown>> = [];
-const lifecycleEvents: string[] = [];
+const lifecycleEvents: Array<{
+  eventName: string;
+  attributes: Record<string, unknown>;
+}> = [];
+const lifecycleEventNames = (): string[] =>
+  lifecycleEvents.map((event) => event.eventName);
+// Simulates the telemetry store failing (degraded DB) for the one test that
+// asserts the terminals swallow it.
+let lifecycleRecorderThrows = false;
 
 mock.module("../telemetry/tool-usage-store.js", () => ({
   recordToolInvocation: (record: Record<string, unknown>) =>
@@ -19,13 +27,22 @@ mock.module("../telemetry/tool-usage-store.js", () => ({
 }));
 
 mock.module("../persistence/lifecycle-events-store.js", () => ({
-  recordLifecycleEvent: (eventName: string) => lifecycleEvents.push(eventName),
+  recordLifecycleEvent: (
+    eventName: string,
+    attributes: Record<string, unknown> = {},
+  ) => {
+    if (lifecycleRecorderThrows) {
+      throw new Error("telemetry db down");
+    }
+    lifecycleEvents.push({ eventName, attributes });
+  },
 }));
 
 import {
   recordToolDenied,
   recordToolError,
   recordToolExecuted,
+  recordToolPermissionDecided,
   recordToolPermissionPrompted,
 } from "../telemetry/tool-audit.js";
 import {
@@ -48,6 +65,7 @@ const ATTRIBUTION = {
 describe("tool audit terminals", () => {
   beforeEach(() => {
     shareAnalytics = true;
+    lifecycleRecorderThrows = false;
     records.length = 0;
     lifecycleEvents.length = 0;
   });
@@ -63,7 +81,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 12,
       attribution: null,
-      wasPrompted: false,
     });
 
     expect(records).toHaveLength(1);
@@ -84,7 +101,6 @@ describe("tool audit terminals", () => {
       reason: "Blocked by deny rule: rm *",
       riskLevel: "high",
       durationMs: 20,
-      wasPrompted: false,
     });
     recordToolDenied({
       conversationId: "conv-2",
@@ -93,7 +109,6 @@ describe("tool audit terminals", () => {
       reason: "Permission denied by user",
       riskLevel: "high",
       durationMs: 22,
-      wasPrompted: false,
     });
 
     expect(records).toHaveLength(2);
@@ -118,7 +133,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 5,
       attribution: null,
-      wasPrompted: false,
     });
 
     expect(records).toHaveLength(1);
@@ -141,7 +155,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 5,
       attribution: null,
-      wasPrompted: false,
     });
     recordToolError({
       conversationId: "conv-input-redact",
@@ -160,7 +173,6 @@ describe("tool audit terminals", () => {
       reason: "Permission denied by user",
       riskLevel: "high",
       durationMs: 5,
-      wasPrompted: false,
     });
 
     expect(records).toHaveLength(3);
@@ -192,7 +204,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 2,
       attribution: null,
-      wasPrompted: false,
     });
 
     expect(records).toHaveLength(1);
@@ -215,7 +226,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 2,
       attribution: null,
-      wasPrompted: false,
     });
 
     expect(records).toHaveLength(1);
@@ -246,7 +256,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 3,
       attribution: null,
-      wasPrompted: false,
     });
 
     expect(records).toHaveLength(1);
@@ -289,7 +298,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 12,
       attribution: null,
-      wasPrompted: false,
     });
 
     expect(records).toHaveLength(1);
@@ -316,7 +324,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 4,
       attribution: null,
-      wasPrompted: false,
     });
 
     expect(records).toHaveLength(1);
@@ -339,7 +346,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 12,
       attribution: ATTRIBUTION,
-      wasPrompted: false,
     });
     recordToolError({
       conversationId: "conv-opt-out",
@@ -395,7 +401,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 12,
       attribution: ATTRIBUTION,
-      wasPrompted: false,
     });
 
     expect(records).toHaveLength(1);
@@ -420,7 +425,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 12,
       attribution: ATTRIBUTION,
-      wasPrompted: false,
     });
     recordToolExecuted({
       conversationId: "conv-attr",
@@ -432,7 +436,6 @@ describe("tool audit terminals", () => {
       riskLevel: "low",
       durationMs: 3,
       attribution: null,
-      wasPrompted: false,
     });
     recordToolDenied({
       conversationId: "conv-attr",
@@ -441,7 +444,6 @@ describe("tool audit terminals", () => {
       reason: "Permission denied by user",
       riskLevel: "high",
       durationMs: 1,
-      wasPrompted: false,
     });
 
     expect(records).toHaveLength(3);
@@ -462,9 +464,7 @@ describe("tool audit terminals", () => {
     expect(records[2].resultBytes).toBeUndefined();
   });
 
-  test("prompted decisions record permission lifecycle telemetry; unprompted do not", () => {
-    recordToolPermissionPrompted("bash");
-    // Prompted allow → executed records a decided event.
+  test("audit terminals record no permission lifecycle telemetry", () => {
     recordToolExecuted({
       conversationId: "conv-prompt",
       toolName: "bash",
@@ -475,9 +475,7 @@ describe("tool audit terminals", () => {
       riskLevel: "high",
       durationMs: 3,
       attribution: null,
-      wasPrompted: true,
     });
-    // Prompted denial → denied records a decided event.
     recordToolDenied({
       conversationId: "conv-prompt",
       toolName: "bash",
@@ -485,26 +483,99 @@ describe("tool audit terminals", () => {
       reason: "Permission denied by user",
       riskLevel: "high",
       durationMs: 1,
-      wasPrompted: true,
     });
-    // Unprompted (auto-approved) execution records nothing.
-    recordToolExecuted({
+
+    expect(lifecycleEvents).toEqual([]);
+  });
+
+  test("prompt and decision carry the same grouping dimensions", () => {
+    const prompt = {
+      toolName: "bash",
+      riskLevel: "high",
+      riskThreshold: "low",
+      surface: "slack",
       conversationId: "conv-prompt",
-      toolName: "file_read",
-      input: { path: "/tmp/a" },
-      resultContent: "ok",
-      resultBytes: 2,
-      decision: "allow",
-      riskLevel: "low",
-      durationMs: 1,
-      attribution: null,
-      wasPrompted: false,
-    });
+    };
+
+    recordToolPermissionPrompted(prompt);
+    recordToolPermissionDecided(prompt, "deny");
 
-    expect(lifecycleEvents).toEqual([
+    expect(lifecycleEventNames()).toEqual([
       "permission_prompt:bash",
-      "permission_decided:bash:allow",
       "permission_decided:bash:deny",
     ]);
+    for (const event of lifecycleEvents) {
+      expect(event.attributes).toEqual({
+        toolName: "bash",
+        riskLevel: "high",
+        riskThreshold: "low",
+        surface: "slack",
+        conversationId: "conv-prompt",
+      });
+    }
+  });
+
+  test("optional grouping dimensions are left unset when unknown", () => {
+    recordToolPermissionPrompted({ toolName: "file_read", riskLevel: "low" });
+
+    const attributes = lifecycleEvents[0]!.attributes;
+    expect(attributes.toolName).toBe("file_read");
+    expect(attributes.riskLevel).toBe("low");
+    expect(attributes.riskThreshold).toBeUndefined();
+    expect(attributes.surface).toBeUndefined();
+    expect(attributes.conversationId).toBeUndefined();
+  });
+
+  test("records an abandoned decision distinctly from a user denial", () => {
+    const prompt = { toolName: "bash", riskLevel: "medium" };
+
+    recordToolPermissionPrompted(prompt);
+    recordToolPermissionDecided(prompt, "abandoned");
+
+    expect(lifecycleEventNames()).toEqual([
+      "permission_prompt:bash",
+      "permission_decided:bash:abandoned",
+    ]);
+  });
+
+  test("truncates a long tool name to the wire event-name bound", () => {
+    const toolName = `mcp__${"a".repeat(80)}__run`;
+    const prompt = { toolName, riskLevel: "high" };
+
+    recordToolPermissionPrompted(prompt);
+    recordToolPermissionDecided(prompt, "abandoned");
+
+    for (const event of lifecycleEvents) {
+      expect(event.eventName.length).toBeLessThanOrEqual(64);
+      // The full name still joins the pair.
+      expect(event.attributes.toolName).toBe(toolName);
+    }
+    expect(lifecycleEvents[1]!.eventName.endsWith(":abandoned")).toBe(true);
+  });
+
+  test("clamps a tool name past the wire tool_name bound", () => {
+    // A field over its bound fails validation, and a failed event is acked and
+    // discarded rather than retried.
+    const toolName = `mcp__${"a".repeat(300)}__run`;
+
+    recordToolPermissionPrompted({ toolName, riskLevel: "high" });
+
+    expect(lifecycleEvents[0]!.attributes.toolName).toBe(
+      toolName.slice(0, 255),
+    );
+  });
+
+  test("a failing lifecycle recorder never propagates out of the terminals", () => {
+    lifecycleRecorderThrows = true;
+
+    expect(() =>
+      recordToolPermissionPrompted({ toolName: "bash", riskLevel: "high" }),
+    ).not.toThrow();
+    expect(() =>
+      recordToolPermissionDecided(
+        { toolName: "bash", riskLevel: "high" },
+        "abandoned",
+      ),
+    ).not.toThrow();
   });
 });