@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/__tests__/conversation-summarize-route.test.ts

@@ -98,7 +98,12 @@ mock.module("../schedule/schedule-store.js", () => ({
   deleteSchedule: async () => {},
 }));
 
+// Spread the actual module so transitive importers of names this
+// factory does not stub keep resolving (a partial factory breaks at
+// import time when the graph gains a new named import).
+const actualFeedWriter = await import("../home/feed-writer.js");
 mock.module("../home/feed-writer.js", () => ({
+  ...actualFeedWriter,
   stripConversationIds: async () => {},
 }));
 

package/src/__tests__/conversation-summarize-up-to.test.ts

@@ -101,6 +101,9 @@ mock.module("../persistence/conversation-crud.js", () => ({
   getConversationOriginInterface: () => null,
   getConversationOriginChannel: () => null,
   getMessages: () => mockDbMessages,
+  // Read by camera-frame retention on the compaction pipeline's summarizer
+  // input. Empty unless a test seeds tagged frames.
+  selectSightFrameCaptureTimes: () => sightFrameCaptureTimes,
   getConversation: () => mockConversation,
   createConversation: () => ({ id: "conv-1" }),
   addMessage: () => ({ id: `msg-${Date.now()}` }),
@@ -114,6 +117,9 @@ mock.module("../persistence/conversation-queries.js", () => ({
   listConversations: () => [],
 }));
 
+/** Tagged camera frames for the retention pass; seeded per test. */
+let sightFrameCaptureTimes = new Map<string, number>();
+
 // Captured defaultCompact invocations + per-test canned result.
 let compactCalls: CompactionContext[] = [];
 let mockCompactResult: ContextWindowResult = makeNoopResult();
@@ -366,6 +372,7 @@ describe("Conversation.summarizeUpToMessage", () => {
     mockCompactResult = makeNoopResult();
     mockDbMessages = threeTurnRows();
     mockConversation = baseConversationRow();
+    sightFrameCaptureTimes = new Map();
   });
 
   test("maps the boundary row straight through when there is no context summary", async () => {
@@ -939,3 +946,98 @@ describe("formatSummarizeUpToResult", () => {
     expect(card).toContain("4 recent messages kept in full.");
   });
 });
+
+/**
+ * `forceCompact`, `maybeCompact`, and `summarizeUpToMessage` all funnel through
+ * the private `runCompaction`, so the retention applied to its summarizer input
+ * covers all three. `forceCompact` is the cheapest of them to drive.
+ */
+describe("direct compaction trims the summarizer's own input", () => {
+  beforeEach(() => {
+    compactCalls = [];
+    slackWatermarkCalls = [];
+    mockCompactResult = makeNoopResult();
+    mockDbMessages = threeTurnRows();
+    mockConversation = baseConversationRow();
+    sightFrameCaptureTimes = new Map();
+  });
+
+  /** A frame as the live history carries it: inline bytes plus its row id. */
+  function frame(attachmentId: string): Message {
+    return {
+      role: "user",
+      content: [
+        {
+          type: "image",
+          source: { type: "base64", media_type: "image/png", data: "AAAAAAAA" },
+          _attachmentId: attachmentId,
+        },
+      ],
+    };
+  }
+
+  function framesInCompactCall(): number {
+    return (compactCalls[0]?.messages ?? []).flatMap((message) =>
+      message.content.filter((block) => block.type === "image"),
+    ).length;
+  }
+
+  function frameStubsInCompactCall(): number {
+    return (compactCalls[0]?.messages ?? []).flatMap((message) =>
+      message.content.filter(
+        (block) =>
+          block.type === "text" &&
+          block.text.startsWith("[Camera frame omitted from context:"),
+      ),
+    ).length;
+  }
+
+  test("bounds an over-full camera history before the summary call", async () => {
+    sightFrameCaptureTimes = new Map([
+      ["f1", 1000],
+      ["f2", 2000],
+      ["f3", 3000],
+      ["f4", 4000],
+    ]);
+    const conversation = makeConversation();
+    conversation.messages = [
+      frame("f1"),
+      frame("f2"),
+      frame("f3"),
+      frame("f4"),
+    ];
+
+    await conversation.forceCompact();
+
+    // The summary call is a provider request like any other, so it carries the
+    // bound rather than every frame the session captured.
+    expect(compactCalls).toHaveLength(1);
+    expect(framesInCompactCall()).toBe(2);
+    expect(frameStubsInCompactCall()).toBe(2);
+  });
+
+  test("leaves an untagged history untouched", async () => {
+    const conversation = makeConversation();
+    conversation.messages = [frame("f1"), frame("f2"), frame("f3")];
+
+    await conversation.forceCompact();
+
+    expect(framesInCompactCall()).toBe(3);
+    expect(frameStubsInCompactCall()).toBe(0);
+  });
+
+  test("summarizeUpToMessage reaches the same trim through the shared seam", async () => {
+    sightFrameCaptureTimes = new Map([
+      ["f1", 1000],
+      ["f2", 2000],
+      ["f3", 3000],
+      ["f4", 4000],
+    ]);
+    const conversation = makeConversation();
+    await conversation.summarizeUpToMessage("m4");
+    // The boundary machinery reloads history from the mocked rows, so this
+    // asserts the seam ran, not the frame maths (covered above).
+    expect(compactCalls).toHaveLength(1);
+    expect(compactCalls[0].fixedTailStartIndex).toBeDefined();
+  });
+});

package/src/__tests__/conversation-wait-for-idle.test.ts

@@ -99,18 +99,6 @@ mock.module("../persistence/attachments-store.js", () => ({
   linkAttachmentToMessage: () => {},
 }));
 
-mock.module("../memory/retriever.js", () => ({
-  buildMemoryRecall: async () => ({
-    enabled: false,
-    degraded: false,
-    injectedText: "",
-    semanticHits: 0,
-    injectedTokens: 0,
-    latencyMs: 0,
-  }),
-  injectMemoryRecallAsUserBlock: (msgs: Message[]) => msgs,
-}));
-
 mock.module("../plugins/defaults/compaction/window-manager.js", () => ({
   ContextWindowManager: class {
     estimateInputTokens() {

package/src/__tests__/conversation-workspace-cache-state.test.ts

@@ -81,11 +81,6 @@ mock.module("../persistence/attachments-store.js", () => ({
   linkAttachmentToMessage: () => {},
 }));
 
-mock.module("../memory/retriever.js", () => ({
-  buildMemoryRecall: async () => null,
-  injectMemoryRecallAsUserBlock: (msgs: Message[]) => msgs,
-}));
-
 mock.module("../memory/query-builder.js", () => ({
   buildMemoryQuery: () => "",
 }));

package/src/__tests__/conversation-workspace-injection.test.ts

@@ -86,23 +86,6 @@ mock.module("../persistence/attachments-store.js", () => ({
   uploadAttachment: () => ({ id: "att-1" }),
   linkAttachmentToMessage: () => {},
 }));
-mock.module("../memory/retriever.js", () => ({
-  buildMemoryRecall: async () => ({
-    enabled: false,
-    degraded: false,
-    reason: null,
-    provider: "mock",
-    model: "mock",
-    injectedText: "",
-    semanticHits: 0,
-    mergedCount: 0,
-    selectedCount: 0,
-    injectedTokens: 0,
-    latencyMs: 0,
-    topCandidates: [],
-  }),
-  injectMemoryRecallAsUserBlock: (msgs: Message[]) => msgs,
-}));
 mock.module("../memory/query-builder.js", () => ({
   buildMemoryQuery: () => "",
 }));

package/src/__tests__/conversation-workspace-tool-tracking.test.ts

@@ -83,23 +83,6 @@ mock.module("../persistence/attachments-store.js", () => ({
   uploadAttachment: () => ({ id: "att-1" }),
   linkAttachmentToMessage: () => {},
 }));
-mock.module("../memory/retriever.js", () => ({
-  buildMemoryRecall: async () => ({
-    enabled: false,
-    degraded: false,
-    reason: null,
-    provider: "mock",
-    model: "mock",
-    injectedText: "",
-    semanticHits: 0,
-    mergedCount: 0,
-    selectedCount: 0,
-    injectedTokens: 0,
-    latencyMs: 0,
-    topCandidates: [],
-  }),
-  injectMemoryRecallAsUserBlock: (msgs: Message[]) => msgs,
-}));
 mock.module("../memory/query-builder.js", () => ({
   buildMemoryQuery: () => "",
 }));

package/src/__tests__/credential-health-service.test.ts

@@ -12,6 +12,8 @@ let mockProviders: Array<{
   pingMethod: string | null;
   pingHeaders: string | null;
   pingBody: string | null;
+  authorizeParams: string | null;
+  scopeSeparator: string | null;
   managedServiceConfigKey?: string;
 }> = [];
 
@@ -191,11 +193,16 @@ function addProvider(
     pingUrl?: string | null;
     pingMethod?: string | null;
     managedServiceConfigKey?: string;
+    authorizeParams?: Record<string, string>;
   },
 ) {
   mockProviders.push({
     provider,
     defaultScopes: JSON.stringify(opts?.defaultScopes ?? []),
+    authorizeParams: opts?.authorizeParams
+      ? JSON.stringify(opts.authorizeParams)
+      : null,
+    scopeSeparator: " ",
     pingUrl: opts?.pingUrl ?? null,
     pingMethod: opts?.pingMethod ?? null,
     pingHeaders: null,
@@ -443,6 +450,44 @@ describe("credential-health-service", () => {
     expect(report.results[0]!.canAutoRecover).toBe(false);
   });
 
+  test("measures a user-token grant against user_scope, not the bot scopes", async () => {
+    // Slack issues two grants from one authorization and the stored token is
+    // the user one, so its grant is compared against `user_scope`. Measuring
+    // it against the bot `scope` parameter reports scopes that grant can never
+    // hold: `channels:join` is bot-only and is never requested for the user.
+    addProvider("slack", {
+      defaultScopes: ["channels:join", "chat:write", "search:read"],
+      authorizeParams: { user_scope: "chat:write,search:read" },
+    });
+    addConnection("slack", "conn-1", {
+      grantedScopes: ["chat:write", "search:read"],
+      expiresAt: Date.now() + 30 * 24 * 60 * 60 * 1000,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).not.toBe("missing_scopes");
+    expect(report.results[0]!.missingScopes).toEqual([]);
+  });
+
+  test("still reports a user scope the installer did not grant", async () => {
+    // Sensitivity check for the test above: comparing against `user_scope`
+    // must keep catching a genuinely declined user scope, not pass everything.
+    addProvider("slack", {
+      defaultScopes: ["channels:join", "chat:write", "search:read"],
+      authorizeParams: { user_scope: "chat:write,search:read" },
+    });
+    addConnection("slack", "conn-1", {
+      grantedScopes: ["chat:write"],
+      expiresAt: Date.now() + 30 * 24 * 60 * 60 * 1000,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).toBe("missing_scopes");
+    expect(report.results[0]!.missingScopes).toEqual(["search:read"]);
+  });
+
   test("returns revoked when ping returns 401", async () => {
     mockFetchResponse = { ok: false, status: 401 };
     addProvider("google", {

package/src/__tests__/credential-record-retire.test.ts

@@ -0,0 +1,256 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import { credentialKey } from "@vellumai/credential-storage";
+import type { CredentialRecord } from "@vellumai/service-contracts/credential-rpc";
+
+import type { CredentialRecordBackend } from "../security/ces-rpc-record-backend.js";
+import {
+  _ensureCesRecordsLoaded,
+  _setMetadataPath,
+  getCredentialMetadata,
+  setCredentialRecordBackend,
+  upsertCredentialMetadata,
+} from "../tools/credentials/metadata-store.js";
+import { getDataDir } from "../util/platform.js";
+
+function leftoverPath(): string {
+  return join(getDataDir(), "credentials", "metadata.json");
+}
+
+function writeLeftover(record: CredentialRecord): void {
+  const path = leftoverPath();
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(
+    path,
+    JSON.stringify({
+      version: 5,
+      credentials: [record],
+    }),
+  );
+}
+
+function leftoverContents(): string {
+  return readFileSync(leftoverPath(), "utf-8");
+}
+
+function makeBackend(): CredentialRecordBackend & {
+  store: Map<string, CredentialRecord>;
+  bulkSetCalls: number;
+  listCalls: number;
+} {
+  const store = new Map<string, CredentialRecord>();
+  const backend: CredentialRecordBackend & {
+    store: Map<string, CredentialRecord>;
+    bulkSetCalls: number;
+    listCalls: number;
+  } = {
+    store,
+    bulkSetCalls: 0,
+    listCalls: 0,
+    isAvailable: () => true,
+    get: async (account) => store.get(account),
+    set: async (account, record) => {
+      store.set(account, record);
+      return true;
+    },
+    delete: async (account) => {
+      if (!store.has(account)) {
+        return "not-found";
+      }
+      store.delete(account);
+      return "deleted";
+    },
+    list: async () => {
+      backend.listCalls += 1;
+      return [...store.entries()].map(([account, record]) => ({
+        account,
+        record,
+      }));
+    },
+    bulkSet: async (records) => {
+      backend.bulkSetCalls += 1;
+      for (const { account, record } of records) {
+        store.set(account, record);
+      }
+      return records.map((entry) => ({ account: entry.account, ok: true }));
+    },
+  };
+  return backend;
+}
+
+describe("CES credential record cache", () => {
+  beforeEach(() => {
+    setCredentialRecordBackend(undefined);
+    _setMetadataPath(null);
+    const leftover = leftoverPath();
+    if (existsSync(leftover)) {
+      rmSync(leftover, { force: true });
+    }
+  });
+
+  afterEach(() => {
+    setCredentialRecordBackend(undefined);
+    _setMetadataPath(null);
+    const leftover = leftoverPath();
+    if (existsSync(leftover)) {
+      rmSync(leftover, { force: true });
+    }
+  });
+
+  test("first catalog read lazy-loads CES records into the in-process cache", async () => {
+    const backend = makeBackend();
+    const record: CredentialRecord = {
+      credentialId: "cred-1",
+      service: "github",
+      field: "token",
+      allowedTools: ["bash"],
+      allowedDomains: [],
+      createdAt: 1,
+      updatedAt: 2,
+    };
+    backend.store.set(credentialKey("github", "token"), record);
+    setCredentialRecordBackend(backend);
+    expect(backend.listCalls).toBe(0);
+
+    getCredentialMetadata("github", "token");
+    await _ensureCesRecordsLoaded();
+    expect(backend.listCalls).toBe(1);
+
+    expect(getCredentialMetadata("github", "token")?.credentialId).toBe(
+      "cred-1",
+    );
+    expect(getCredentialMetadata("github", "token")?.allowedTools).toEqual([
+      "bash",
+    ]);
+    getCredentialMetadata("github", "token");
+    await _ensureCesRecordsLoaded();
+    expect(backend.listCalls).toBe(1);
+  });
+
+  test("lazy load leaves leftover metadata.json in place and ignores it", async () => {
+    const leftoverRecord: CredentialRecord = {
+      credentialId: "cred-leftover",
+      service: "github",
+      field: "token",
+      allowedTools: ["bash"],
+      allowedDomains: ["github.com"],
+      createdAt: 1,
+      updatedAt: 2,
+    };
+    writeLeftover(leftoverRecord);
+    const before = leftoverContents();
+
+    const backend = makeBackend();
+    backend.store.set(credentialKey("github", "token"), leftoverRecord);
+    setCredentialRecordBackend(backend);
+
+    getCredentialMetadata("github", "token");
+    await _ensureCesRecordsLoaded();
+
+    expect(existsSync(leftoverPath())).toBe(true);
+    expect(leftoverContents()).toBe(before);
+    expect(backend.bulkSetCalls).toBe(0);
+    expect(getCredentialMetadata("github", "token")?.allowedTools).toEqual([
+      "bash",
+    ]);
+  });
+
+  test("lazy load ignores leftover metadata.json when CES list fails", async () => {
+    const leftoverRecord: CredentialRecord = {
+      credentialId: "cred-keep",
+      service: "slack_channel",
+      field: "bot_token",
+      allowedTools: ["bash"],
+      allowedDomains: [],
+      createdAt: 1,
+      updatedAt: 2,
+    };
+    writeLeftover(leftoverRecord);
+
+    const backend = makeBackend();
+    backend.list = async () => null;
+    setCredentialRecordBackend(backend);
+
+    getCredentialMetadata("slack_channel", "bot_token");
+    await _ensureCesRecordsLoaded();
+
+    expect(existsSync(leftoverPath())).toBe(true);
+    expect(backend.bulkSetCalls).toBe(0);
+    expect(
+      getCredentialMetadata("slack_channel", "bot_token"),
+    ).toBeUndefined();
+  });
+
+  test("lazy load ignores leftover metadata.json when CES has no leftover accounts", async () => {
+    const leftoverRecord: CredentialRecord = {
+      credentialId: "cred-missing",
+      service: "github",
+      field: "token",
+      allowedTools: ["bash"],
+      allowedDomains: [],
+      createdAt: 1,
+      updatedAt: 2,
+    };
+    writeLeftover(leftoverRecord);
+
+    const backend = makeBackend();
+    setCredentialRecordBackend(backend);
+
+    getCredentialMetadata("github", "token");
+    await _ensureCesRecordsLoaded();
+
+    expect(existsSync(leftoverPath())).toBe(true);
+    expect(backend.store.size).toBe(0);
+    expect(backend.bulkSetCalls).toBe(0);
+    expect(getCredentialMetadata("github", "token")).toBeUndefined();
+  });
+
+  test("lazy load does not throw when CES isAvailable throws", async () => {
+    const backend = makeBackend();
+    backend.isAvailable = () => {
+      throw new Error("CES boom");
+    };
+    setCredentialRecordBackend(backend);
+
+    getCredentialMetadata("github", "token");
+    await _ensureCesRecordsLoaded();
+  });
+
+  test("upsert write-throughs to CES without updating leftover metadata.json", async () => {
+    const leftoverRecord: CredentialRecord = {
+      credentialId: "cred-leftover",
+      service: "github",
+      field: "token",
+      allowedTools: ["bash"],
+      allowedDomains: [],
+      createdAt: 1,
+      updatedAt: 2,
+    };
+    writeLeftover(leftoverRecord);
+    const leftoverBefore = leftoverContents();
+
+    const backend = makeBackend();
+    backend.store.set(credentialKey("github", "token"), leftoverRecord);
+    setCredentialRecordBackend(backend);
+    getCredentialMetadata("github", "token");
+    await _ensureCesRecordsLoaded();
+    expect(existsSync(leftoverPath())).toBe(true);
+
+    const created = upsertCredentialMetadata("slack_channel", "bot_token", {
+      allowedTools: ["bash"],
+    });
+    await Promise.resolve();
+
+    expect(existsSync(leftoverPath())).toBe(true);
+    expect(leftoverContents()).toBe(leftoverBefore);
+    expect(
+      backend.store.get(credentialKey("slack_channel", "bot_token"))
+        ?.credentialId,
+    ).toBe(created.credentialId);
+    expect(getCredentialMetadata("slack_channel", "bot_token")?.allowedTools).toEqual(
+      ["bash"],
+    );
+  });
+});

package/src/__tests__/credential-record-write-through.test.ts

@@ -1,3 +1,5 @@
+import { existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
 import { afterEach, describe, expect, test } from "bun:test";
 
 import { credentialKey } from "@vellumai/credential-storage";
@@ -6,10 +8,10 @@ import type { CredentialRecord } from "@vellumai/service-contracts/credential-rp
 import type { CredentialRecordBackend } from "../security/ces-rpc-record-backend.js";
 import {
   _setMetadataPath,
-  persistCredentialMetadata,
   setCredentialRecordBackend,
   upsertCredentialMetadata,
 } from "../tools/credentials/metadata-store.js";
+import { getDataDir } from "../util/platform.js";
 
 function makeBackend(): CredentialRecordBackend & {
   store: Map<string, CredentialRecord>;
@@ -45,6 +47,10 @@ describe("CES credential record write-through", () => {
   afterEach(() => {
     setCredentialRecordBackend(undefined);
     _setMetadataPath(null);
+    const leftover = join(getDataDir(), "credentials", "metadata.json");
+    if (existsSync(leftover)) {
+      rmSync(leftover, { force: true });
+    }
   });
 
   test("upsert write-through updates the CES backend", async () => {
@@ -54,7 +60,6 @@ describe("CES credential record write-through", () => {
     const created = upsertCredentialMetadata("slack_channel", "bot_token", {
       allowedTools: ["bash"],
     });
-    await persistCredentialMetadata(created);
 
     const stored = backend.store.get(
       credentialKey("slack_channel", "bot_token"),
@@ -68,10 +73,9 @@ describe("CES credential record write-through", () => {
     setCredentialRecordBackend(backend);
     _setMetadataPath("/tmp/does-not-write-through-metadata.json");
 
-    const created = upsertCredentialMetadata("github", "token", {
+    upsertCredentialMetadata("github", "token", {
       allowedTools: ["bash"],
     });
-    await persistCredentialMetadata(created);
 
     expect(backend.store.size).toBe(0);
   });

package/src/__tests__/db-conversation-fork-lineage-migration.test.ts

@@ -3,8 +3,6 @@ import { afterAll, beforeEach, describe, expect, test } from "bun:test";
 
 import { drizzle } from "drizzle-orm/bun-sqlite";
 
-const originalBunTest = process.env.BUN_TEST;
-
 import { getSqliteFrom } from "../persistence/db-connection.js";
 import { migrateConversationForkLineage } from "../persistence/migrations/183-add-conversation-fork-lineage.js";
 import * as schema from "../persistence/schema/index.js";
@@ -62,12 +60,10 @@ function resetMigrationTestDb(): void {
 
 describe("conversation fork lineage migration", () => {
   beforeEach(() => {
-    process.env.BUN_TEST = "0";
     resetMigrationTestDb();
   });
 
   afterAll(() => {
-    process.env.BUN_TEST = originalBunTest;
     resetMigrationTestDb();
   });
 

package/src/__tests__/db-conversation-inference-profile-migration.test.ts

@@ -3,8 +3,6 @@ import { afterAll, beforeEach, describe, expect, test } from "bun:test";
 
 import { drizzle } from "drizzle-orm/bun-sqlite";
 
-const originalBunTest = process.env.BUN_TEST;
-
 import { _resetDisplayOrderMigrationForTests } from "../persistence/conversation-display-order-migration.js";
 import { _resetGroupMigrationForTests } from "../persistence/conversation-group-migration.js";
 import { getSqliteFrom } from "../persistence/db-connection.js";
@@ -68,12 +66,10 @@ function resetMigrationTestDb(): void {
 
 describe("conversation inference profile migration", () => {
   beforeEach(() => {
-    process.env.BUN_TEST = "0";
     resetMigrationTestDb();
   });
 
   afterAll(() => {
-    process.env.BUN_TEST = originalBunTest;
     resetMigrationTestDb();
   });
 

package/src/__tests__/db-llm-request-log-provider-migration.test.ts

@@ -10,8 +10,6 @@ import {
 
 import { drizzle } from "drizzle-orm/bun-sqlite";
 
-const originalBunTest = process.env.BUN_TEST;
-
 import { getSqliteFrom } from "../persistence/db-connection.js";
 import { migrateLlmRequestLogProvider } from "../persistence/migrations/184-llm-request-log-provider.js";
 import * as schema from "../persistence/schema/index.js";
@@ -48,7 +46,6 @@ function bootstrapPreProviderLlmRequestLogs(raw: Database): void {
 
 describe("llm_request_logs provider migration", () => {
   beforeEach(() => {
-    process.env.BUN_TEST = "0";
     resetDbForTesting();
   });
 
@@ -57,11 +54,6 @@ describe("llm_request_logs provider migration", () => {
   });
 
   afterAll(() => {
-    if (originalBunTest === undefined) {
-      delete process.env.BUN_TEST;
-    } else {
-      process.env.BUN_TEST = originalBunTest;
-    }
     resetDbForTesting();
   });