@vellumai/assistant 0.11.7-dev.202609011637.5f3cbff → 0.11.7-dev.202609011820.193fbf9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.7-dev.202609011637.5f3cbff",
+  "version": "0.11.7-dev.202609011820.193fbf9",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/channel-availability-routes.test.ts

@@ -13,6 +13,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { CHANNEL_METADATA } from "../channels/types.js";
+import { credentialKey } from "../security/credential-key.js";
 
 // ---------------------------------------------------------------------------
 // Mock state — flipped per-test
@@ -29,6 +30,11 @@ let mockEmailAddressesResponse: {
   body: { count: 0, results: [] },
 };
 let mockFetchThrows = false;
+let mockSecureKeys: Record<string, string> = {};
+
+mock.module("../security/secure-keys.js", () => ({
+  getSecureKeyAsync: async (key: string) => mockSecureKeys[key] ?? null,
+}));
 
 mock.module("../platform/client.js", () => ({
   VellumPlatformClient: {
@@ -83,6 +89,7 @@ describe("channels/available", () => {
       body: { count: 0, results: [] },
     };
     mockFetchThrows = false;
+    mockSecureKeys = {};
   });
 
   test("base list only when no email address registered", async () => {
@@ -126,6 +133,14 @@ describe("channels/available", () => {
     expect(result.channels.map((c) => c.id)).toContain("email");
   });
 
+  test("appends email when a your-own provider credential is stored", async () => {
+    mockSecureKeys[credentialKey("resend", "api_key")] = "stored";
+
+    const result = (await handler({})) as HandlerResult;
+
+    expect(result.channels.map((c) => c.id)).toContain("email");
+  });
+
   test("base list only when platform returns non-ok", async () => {
     mockEmailAddressesResponse = {
       ok: false,

package/src/__tests__/channel-delivery-store.test.ts

@@ -10,10 +10,11 @@ import { getDb } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
 import {
   clearPayload,
-  findConversationByProviderMessageId,
+  findMessageByProviderMessageId,
   findMessageBySourceId,
   linkMessage,
   recordInbound,
+  recordOutboundPost,
   storePayload,
 } from "../persistence/delivery-crud.js";
 import {
@@ -52,6 +53,7 @@ await initializeDb();
 function resetTables() {
   const db = getDb();
   db.run("DELETE FROM channel_inbound_events");
+  db.run("DELETE FROM channel_outbound_posts");
   db.run("DELETE FROM messages");
   db.run("DELETE FROM conversation_keys");
   db.run("DELETE FROM external_conversation_bindings");
@@ -147,32 +149,26 @@ describe("channel-delivery-store", () => {
       .run();
 
     expect(
-      findConversationByProviderMessageId(
-        "discord",
-        chatId,
-        "1234567890123456789",
-      ),
-    ).toBe(minted.conversationId);
+      findMessageByProviderMessageId("discord", chatId, "1234567890123456789"),
+    ).toEqual({
+      messageId: "assistant-post-1",
+      conversationId: minted.conversationId,
+    });
     // A split reply posts several provider messages from one row; any of
     // their ids resolves it.
     expect(
-      findConversationByProviderMessageId(
-        "discord",
-        chatId,
-        "2234567890123456789",
-      ),
-    ).toBe(minted.conversationId);
+      findMessageByProviderMessageId("discord", chatId, "2234567890123456789"),
+    ).toEqual({
+      messageId: "assistant-post-1",
+      conversationId: minted.conversationId,
+    });
     // The scan is scoped to the reaction's own channel address: the same id
     // is invisible from another channel's or another chat's key space.
     expect(
-      findConversationByProviderMessageId(
-        "telegram",
-        chatId,
-        "1234567890123456789",
-      ),
+      findMessageByProviderMessageId("telegram", chatId, "1234567890123456789"),
     ).toBeNull();
     expect(
-      findConversationByProviderMessageId(
+      findMessageByProviderMessageId(
         "discord",
         "other-chat",
         "1234567890123456789",
@@ -206,7 +202,7 @@ describe("channel-delivery-store", () => {
       .run();
     linkMessage(minted.eventId, "linked-user-row");
     expect(
-      findConversationByProviderMessageId("telegram", chatId, "tg-linked-1"),
+      findMessageByProviderMessageId("telegram", chatId, "tg-linked-1"),
     ).toBeNull();
 
     // A crash-window row: persisted with its envelope but its event link
@@ -218,8 +214,11 @@ describe("channel-delivery-store", () => {
       .where(eq(messages.id, "orphan-user-row"))
       .run();
     expect(
-      findConversationByProviderMessageId("telegram", chatId, "tg-orphan-1"),
-    ).toBe(minted.conversationId);
+      findMessageByProviderMessageId("telegram", chatId, "tg-orphan-1"),
+    ).toEqual({
+      messageId: "orphan-user-row",
+      conversationId: minted.conversationId,
+    });
 
     // A legacy linked row whose event carries no source_message_id:
     // findMessageBySourceId matches only that column, so the fallback must
@@ -233,8 +232,63 @@ describe("channel-delivery-store", () => {
       .run();
     linkMessage(legacy.eventId, "legacy-user-row");
     expect(
-      findConversationByProviderMessageId("telegram", chatId, "tg-legacy-1"),
-    ).toBe(legacy.conversationId);
+      findMessageByProviderMessageId("telegram", chatId, "tg-legacy-1"),
+    ).toEqual({
+      messageId: "legacy-user-row",
+      conversationId: legacy.conversationId,
+    });
+  });
+
+  test("the outbound-posts index resolves a post exactly, at any age", () => {
+    const chatId = "999000111222333444";
+    const minted = recordInbound("discord", chatId, "evt-index-seed");
+    const db = getDb();
+    // The row's envelope names nothing: resolution comes from the index
+    // alone, proving the table is the contract rather than a cache in
+    // front of the scan.
+    db.insert(messages)
+      .values({
+        id: "assistant-indexed-post",
+        conversationId: minted.conversationId,
+        role: "assistant",
+        content: "indexed reply",
+        createdAt: Date.now(),
+        metadata: null,
+      })
+      .run();
+    recordOutboundPost({
+      sourceChannel: "discord",
+      externalChatId: chatId,
+      providerMessageId: "555666777888999000",
+      messageId: "assistant-indexed-post",
+      conversationId: minted.conversationId,
+    });
+    // Idempotent on redelivery.
+    recordOutboundPost({
+      sourceChannel: "discord",
+      externalChatId: chatId,
+      providerMessageId: "555666777888999000",
+      messageId: "assistant-indexed-post",
+      conversationId: minted.conversationId,
+    });
+
+    expect(
+      findMessageByProviderMessageId("discord", chatId, "555666777888999000"),
+    ).toEqual({
+      messageId: "assistant-indexed-post",
+      conversationId: minted.conversationId,
+    });
+    // Channel and chat scoping hold on the index path too.
+    expect(
+      findMessageByProviderMessageId("telegram", chatId, "555666777888999000"),
+    ).toBeNull();
+    expect(
+      findMessageByProviderMessageId(
+        "discord",
+        "other-chat",
+        "555666777888999000",
+      ),
+    ).toBeNull();
   });
 
   test("same chat on same channel reuses the same conversation", () => {

package/src/__tests__/channel-readiness-routes.test.ts

@@ -10,9 +10,11 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 // ---------------------------------------------------------------------------
 // Mocks — must be set up before importing the service
 // ---------------------------------------------------------------------------
+import type { RegisteredInboxState } from "../email/registered-inbox.js";
 
 let mockSecureKeys: Record<string, string>;
 let mockHasTwilioCredentials: boolean;
+let mockRegisteredInbox: RegisteredInboxState;
 
 mock.module("../calls/twilio-rest.js", () => ({
   hasTwilioCredentials: () => mockHasTwilioCredentials,
@@ -25,6 +27,11 @@ mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: async (key: string) => mockSecureKeys[key] ?? null,
 }));
 
+mock.module("../email/registered-inbox.js", () => ({
+  resolveRegisteredInbox: async () => mockRegisteredInbox,
+  invalidateRegisteredInboxCache: () => {},
+}));
+
 // ---------------------------------------------------------------------------
 // Import under test
 // ---------------------------------------------------------------------------
@@ -45,6 +52,7 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
     setConfig("email", {});
     mockSecureKeys = {};
     mockHasTwilioCredentials = false;
+    mockRegisteredInbox = { status: "none" };
   });
 
   // -------------------------------------------------------------------------
@@ -102,12 +110,15 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
       expect(ingressCheck!.passed).toBe(false);
     });
 
-    test("ready when all prerequisites are met (including inbox)", async () => {
+    test("ready when the platform reports a registered inbox", async () => {
       setConfig("ingress", {
         publicBaseUrl: "https://example.com",
         enabled: true,
       });
-      setConfig("email", { address: "user@example.com" });
+      mockRegisteredInbox = {
+        status: "registered",
+        address: "assistant@example.com",
+      };
       const service = createReadinessService();
       const [snapshot] = await service.getReadiness("email", true);
 
@@ -115,7 +126,26 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
       expect(snapshot.reasons).toHaveLength(0);
     });
 
-    test("not ready when inbox is missing (remote check)", async () => {
+    test("platform registration decides the check; local config cannot", async () => {
+      // Registration lives on the platform. A stray local `email.address`
+      // config value (a key nothing writes) must not make an unregistered
+      // inbox pass.
+      setConfig("ingress", {
+        publicBaseUrl: "https://example.com",
+        enabled: true,
+      });
+      setConfig("email", { address: "stale@example.com" });
+      mockRegisteredInbox = { status: "none" };
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email", true);
+
+      expect(snapshot.ready).toBe(false);
+      expect(snapshot.reasons.some((r) => r.code === "inbox_configured")).toBe(
+        true,
+      );
+    });
+
+    test("not ready when the platform reports no inbox (remote check)", async () => {
       setConfig("ingress", {
         publicBaseUrl: "https://example.com",
         enabled: true,
@@ -129,6 +159,69 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
       );
     });
 
+    test("missing platform credentials fail the inbox check", async () => {
+      setConfig("ingress", {
+        publicBaseUrl: "https://example.com",
+        enabled: true,
+      });
+      mockRegisteredInbox = { status: "no_platform" };
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email", true);
+
+      expect(snapshot.ready).toBe(false);
+      expect(snapshot.reasons.some((r) => r.code === "inbox_configured")).toBe(
+        true,
+      );
+    });
+
+    test("a your-own provider credential passes the inbox check", async () => {
+      setConfig("ingress", {
+        publicBaseUrl: "https://example.com",
+        enabled: true,
+      });
+      mockRegisteredInbox = { status: "none" };
+      mockSecureKeys[credentialKey("resend", "api_key")] = "stored";
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email", true);
+
+      expect(snapshot.ready).toBe(true);
+      expect(snapshot.reasons).toHaveLength(0);
+    });
+
+    test("a your-own credential decides even when the platform is unreachable", async () => {
+      setConfig("ingress", {
+        publicBaseUrl: "https://example.com",
+        enabled: true,
+      });
+      mockRegisteredInbox = { status: "unavailable", detail: "HTTP 503" };
+      mockSecureKeys[credentialKey("mailgun", "api_key")] = "stored";
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email", true);
+
+      expect(snapshot.ready).toBe(true);
+    });
+
+    test("unreachable platform is indeterminate, not a fault", async () => {
+      setConfig("ingress", {
+        publicBaseUrl: "https://example.com",
+        enabled: true,
+      });
+      mockRegisteredInbox = { status: "unavailable", detail: "HTTP 503" };
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email", true);
+
+      // No positive confirmation, so the channel cannot report ready, but an
+      // unanswerable question is not a fault and must not be listed as one.
+      expect(snapshot.ready).toBe(false);
+      expect(snapshot.reasons.some((r) => r.code === "inbox_configured")).toBe(
+        false,
+      );
+      const remoteCheck = snapshot.remoteChecks?.find(
+        (c) => c.name === "inbox_configured",
+      );
+      expect(remoteCheck?.indeterminate).toBe(true);
+    });
+
     test("local-only readiness still passes without inbox check", async () => {
       setConfig("ingress", {
         publicBaseUrl: "https://example.com",

package/src/__tests__/channel-readiness-service.test.ts

@@ -369,18 +369,33 @@ describe("ChannelReadinessService", () => {
     });
   });
 
-  test("email readiness ignores platform connectivity", async () => {
-    // Email passes `allowManagedCallbacks: false`, so the managed tiers are
-    // not offered to it and only a real ingress URL counts.
+  test("email readiness accepts a platform-connected assistant with no ingress", async () => {
+    // Inbound email arrives through the platform callback route the gateway
+    // registers (`registerEmailCallbackRoute`, the same pattern as Telegram),
+    // so a platform-connected assistant with no public ingress URL still
+    // receives email and must not report missing ingress.
     mockPlatformConnected = true;
 
     const readiness = createReadinessService();
     const [snapshot] = await readiness.getReadiness("email");
 
+    expect(snapshot.localChecks).toContainEqual({
+      name: "ingress",
+      passed: true,
+      message: "Managed platform callback routing is configured",
+    });
+  });
+
+  test("email readiness reports missing ingress when nothing can route inbound", async () => {
+    mockPlatformConnected = false;
+
+    const readiness = createReadinessService();
+    const [snapshot] = await readiness.getReadiness("email");
+
     expect(snapshot.localChecks).toContainEqual({
       name: "ingress",
       passed: false,
-      message: "Public ingress URL is not configured or disabled",
+      message: "No public ingress URL or managed callback route is configured",
     });
   });
 

package/src/__tests__/channel-reply-delivery.test.ts

@@ -159,6 +159,15 @@ mock.module("../persistence/conversation-crud.js", () => ({
   reserveMessage: mock(async () => ({ id: "msg-reserve" })),
 }));
 
+// The reconciler writes the outbound-posts index through delivery-crud;
+// stub it so this suite stays DB-free while capturing the writes.
+const recordedOutboundPosts: Array<Record<string, string>> = [];
+mock.module("../persistence/delivery-crud.js", () => ({
+  recordOutboundPost: (post: Record<string, string>) => {
+    recordedOutboundPosts.push(post);
+  },
+}));
+
 mock.module("../persistence/attachments-store.js", () => ({
   getAttachmentMetadataForMessage: (messageId: string) =>
     attachmentsByMessageId.get(messageId) ?? [],

package/src/__tests__/conversation-load-history-repair.test.ts

@@ -589,6 +589,53 @@ describe("loadFromDb history repair", () => {
     expect(allText).not.toContain("hunter2");
   });
 
+  test("the assistant's own deleted post keeps its content plus a visibility marker", async () => {
+    mockConversation = {
+      id: "conv-1",
+      contextSummary: null,
+      contextCompactedMessageCount: 0,
+      totalInputTokens: 0,
+      totalOutputTokens: 0,
+      totalEstimatedCost: 0,
+    };
+    mockDbMessages = [
+      {
+        id: "m1",
+        role: "user",
+        content: [{ type: "text", text: "What time is the meeting?" }],
+      },
+      {
+        id: "m2",
+        role: "assistant",
+        content: [{ type: "text", text: "The meeting is at 3pm." }],
+        metadata: JSON.stringify({
+          providerMeta: JSON.stringify({
+            source: "discord",
+            conversationExternalId: "chan-1",
+            messageId: "555.2",
+            eventKind: "message",
+            deletedAt: 1700000001000,
+          }),
+        }),
+      },
+    ];
+
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+    const assistantRow = conversation
+      .getMessages()
+      .find((m) => m.role === "assistant");
+    const texts = (assistantRow?.content ?? [])
+      .filter((b) => b.type === "text")
+      .map((b) => (b.type === "text" ? b.text : ""));
+    // Erasure is for a retracted user message; the assistant's own words
+    // stay (it did say them), and the rendered fact is lost visibility.
+    expect(texts.join("\n")).toContain("The meeting is at 3pm.");
+    expect(texts.join("\n")).toContain(
+      "[This message was deleted from the channel and is no longer visible to participants]",
+    );
+  });
+
   test("a reaction never quotes a target that was later deleted", async () => {
     mockConversation = {
       id: "conv-1",
@@ -703,6 +750,77 @@ describe("loadFromDb history repair", () => {
     expect(allText).not.toContain("an earlier message");
   });
 
+  test("a partially deleted split reply quotes only its surviving posts", async () => {
+    mockConversation = {
+      id: "conv-1",
+      contextSummary: null,
+      contextCompactedMessageCount: 0,
+      totalInputTokens: 0,
+      totalOutputTokens: 0,
+      totalEstimatedCost: 0,
+    };
+    const reactionRow = (target: string, emoji: string, id: string) => ({
+      id,
+      role: "user",
+      content: [{ type: "text", text: "[reaction]" }],
+      metadata: JSON.stringify({
+        providerMeta: JSON.stringify({
+          source: "discord",
+          conversationExternalId: "chan-1",
+          eventKind: "reaction",
+          reaction: {
+            targetMessageId: target,
+            emoji,
+            op: "added",
+            actorDisplayName: "Alice",
+          },
+        }),
+      }),
+    });
+    mockDbMessages = [
+      {
+        id: "m1",
+        role: "assistant",
+        content: [{ type: "text", text: "Deploy finished cleanly." }],
+        metadata: JSON.stringify({
+          providerMeta: JSON.stringify({
+            source: "discord",
+            conversationExternalId: "chan-1",
+            messageId: "555.1",
+            additionalMessageIds: ["555.2"],
+            deletedMessageIds: ["555.2"],
+            eventKind: "message",
+          }),
+        }),
+      },
+      // Reaction on the surviving post: still quotable.
+      reactionRow("555.1", "tada", "m2"),
+      // Reaction on the deleted post: degrades to the unresolved form
+      // rather than quoting content no longer on the channel.
+      reactionRow("555.2", "eyes", "m3"),
+    ];
+
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+    const allText = conversation
+      .getMessages()
+      .flatMap((m) => m.content)
+      .filter((b) => b.type === "text")
+      .map((b) => (b.type === "text" ? b.text : ""))
+      .join("\n");
+    // The row itself is NOT fully deleted: its content stays.
+    expect(allText).toContain("Deploy finished cleanly.");
+    // :tada: (surviving target) quotes; :eyes: (deleted target) does not.
+    const tadaLine = allText
+      .split("\n")
+      .find((line) => line.includes(":tada:"));
+    const eyesLine = allText
+      .split("\n")
+      .find((line) => line.includes(":eyes:"));
+    expect(tadaLine).toContain("Deploy finished cleanly.");
+    expect(eyesLine).toContain("an earlier message");
+  });
+
   test("the assistant's own reaction row renders second-person", async () => {
     mockConversation = {
       id: "conv-1",

package/src/__tests__/credential-security-invariants.test.ts

@@ -238,6 +238,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "providers/inference/connection-availability.ts", // shared (provider, connection) availability status (credential presence check only; value never leaves the helper)
       "plugin-api/resolve-credential.ts", // plugin-facing resolveCredential: reveal-equivalent plaintext read, scoped to the in-context plugin's own service
       "tools/credentials/store.ts", // shared credential write path (setSecureKeyAsync only; no reads) behind credentials/set and plugin-facing storeCredential
+      "email/byo-email-credential.ts", // BYO email provider configuration check (credential presence only; value never leaves the helper)
     ]);
 
     const thisDir = dirname(fileURLToPath(import.meta.url));
@@ -486,7 +487,6 @@ describe("Invariant 4: credentials only used for allowed purpose", () => {
   });
 });
 
-
 // ---------------------------------------------------------------------------
 // Invariant 6 — oauth2ClientSecret never in plaintext metadata
 // ---------------------------------------------------------------------------