@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/__tests__/guardian-card-withdrawal.test.ts

@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-const completeSurfaceAndNotify = mock(() => {});
-const markSurfaceCompleted = mock(() => {});
+const completeSurfaceAndNotify = mock(() => true);
+const markSurfaceCompleted = mock(() => true);
 mock.module("../daemon/conversation-surfaces.js", () => ({
   completeSurfaceAndNotify,
   markSurfaceCompleted,
@@ -20,7 +20,7 @@ mock.module("../messaging/providers/discord/withdraw.js", () => ({
 }));
 
 const withdrawTelegramApprovalCard = mock(
-  async (_params: Record<string, unknown>) => {},
+  async (_params: Record<string, unknown>) => ({ complete: true }),
 );
 mock.module("../messaging/providers/telegram-bot/withdraw.js", () => ({
   withdrawTelegramApprovalCard,
@@ -355,12 +355,104 @@ describe("withdrawGuardianRequestCards", () => {
         status: "approved",
         originChannel: "telegram",
       }),
-    ).resolves.toBeUndefined();
+    ).resolves.toEqual({ complete: false });
 
     // The in-app card was still withdrawn despite the Slack failure.
     expect(completeSurfaceAndNotify).toHaveBeenCalledTimes(1);
   });
 
+  test("completes the in-app projection of a channel card's paired conversation", async () => {
+    // A channel delivery is paired with a conversation whose in-app rendering
+    // carries the same actionable card; the channel edit alone leaves that
+    // projection clickable after the decision (LUM-3489).
+    const req = makeRequest({ kind: "tool_approval", toolName: "shell" });
+    const slack = bridgeState.seedDelivery({
+      requestId: req.id,
+      destinationChannel: "slack",
+      destinationChatId: "C1",
+      destinationMessageId: "1.0",
+      destinationConversationId: "conv-dm",
+    });
+
+    await withdrawGuardianRequestCards({
+      request: req,
+      status: "approved",
+      originChannel: "slack",
+    });
+
+    expect(withdrawSlackApprovalCard).toHaveBeenCalledTimes(1);
+    expect(completeSurfaceAndNotify).toHaveBeenCalledWith(
+      "conv-dm",
+      `tool-approval-${req.id}`,
+      "Approved",
+    );
+    const byId = new Map(deliveriesFor(req.id).map((d) => [d.id, d.status]));
+    expect(byId.get(slack.id)).toBe("withdrawn");
+  });
+
+  test("suppresses only the acting conversation's broadcast for an in-app decision", async () => {
+    // Same request, two in-app projections: the vellum card and a channel
+    // card's paired conversation. The acting client's optimistic completion
+    // covers only the conversation it acted in; the sibling still needs its
+    // live ui_surface_complete.
+    const req = makeRequest({ kind: "tool_approval", toolName: "shell" });
+    bridgeState.seedDelivery({
+      requestId: req.id,
+      destinationChannel: "vellum",
+      destinationConversationId: "conv-acting",
+    });
+    bridgeState.seedDelivery({
+      requestId: req.id,
+      destinationChannel: "slack",
+      destinationChatId: "C1",
+      destinationMessageId: "1.0",
+      destinationConversationId: "conv-sibling",
+    });
+
+    await withdrawGuardianRequestCards({
+      request: req,
+      status: "approved",
+      originChannel: "vellum",
+      originConversationId: "conv-acting",
+    });
+
+    expect(markSurfaceCompleted).toHaveBeenCalledWith(
+      { conversationId: "conv-acting" },
+      `tool-approval-${req.id}`,
+      "Approved",
+    );
+    expect(completeSurfaceAndNotify).toHaveBeenCalledWith(
+      "conv-sibling",
+      `tool-approval-${req.id}`,
+      "Approved",
+    );
+    expect(completeSurfaceAndNotify).toHaveBeenCalledTimes(1);
+  });
+
+  test("a failed in-app persist on a channel-paired projection holds the receipt back", async () => {
+    const req = makeRequest({ kind: "tool_approval", toolName: "shell" });
+    const slack = bridgeState.seedDelivery({
+      requestId: req.id,
+      destinationChannel: "slack",
+      destinationChatId: "C1",
+      destinationMessageId: "1.0",
+      destinationConversationId: "conv-dm",
+    });
+    completeSurfaceAndNotify.mockReturnValueOnce(false);
+
+    const result = await withdrawGuardianRequestCards({
+      request: req,
+      status: "approved",
+      originChannel: "telegram",
+    });
+
+    // The Slack edit landed, but the paired conversation's block would revert
+    // to a clickable card on reload, so the surface stays unreceipted.
+    expect(result.complete).toBe(false);
+    const byId = new Map(deliveriesFor(req.id).map((d) => [d.id, d.status]));
+    expect(byId.get(slack.id)).not.toBe("withdrawn");
+  });
+
   test("tool-approval cards resolve to the tool-approval surface id", async () => {
     const req = makeRequest({ kind: "tool_approval", toolName: "shell" });
     bridgeState.seedDelivery({
@@ -438,8 +530,131 @@ describe("withdrawGuardianRequestCards", () => {
       "Denied",
     );
   });
-});
 
+  test("a Telegram keyboard that stayed live holds the completeness back", async () => {
+    // The nested boolean is the whole receipt: clearInlineKeyboard already
+    // reports the failed edit, and dropping it once made the sweep confirm
+    // an expiry while the card's buttons stayed actionable.
+    const req = makeRequest({ sourceChannel: "telegram" });
+    bridgeState.seedDelivery({
+      requestId: req.id,
+      destinationChannel: "telegram",
+      destinationChatId: "T1",
+      destinationMessageId: "9",
+    });
+    withdrawTelegramApprovalCard.mockResolvedValueOnce({ complete: false });
+
+    const result = await withdrawGuardianRequestCards({
+      request: req,
+      status: "expired",
+    });
+
+    expect(result.complete).toBe(false);
+  });
+
+  test("a failed in-app persistence write holds the completeness back", async () => {
+    // markSurfaceCompleted's false means the persisted block reverts to a
+    // pending, clickable card on the next reload; the broadcast still goes
+    // out, but the caller's receipt must wait for a durable write.
+    const req = makeRequest();
+    bridgeState.seedDelivery({
+      requestId: req.id,
+      destinationChannel: "vellum",
+      destinationConversationId: "conv-1",
+    });
+    completeSurfaceAndNotify.mockReturnValueOnce(false);
+
+    const result = await withdrawGuardianRequestCards({
+      request: req,
+      status: "expired",
+    });
+
+    expect(result.complete).toBe(false);
+  });
+
+  test("a surface that succeeded on retry reports complete", async () => {
+    const req = makeRequest({ sourceChannel: "telegram" });
+    bridgeState.seedDelivery({
+      requestId: req.id,
+      destinationChannel: "telegram",
+      destinationChatId: "T1",
+      destinationMessageId: "9",
+    });
+
+    const result = await withdrawGuardianRequestCards({
+      request: req,
+      status: "expired",
+    });
+
+    expect(result.complete).toBe(true);
+  });
+
+  test("each durably withdrawn surface marks its delivery row as the receipt", async () => {
+    const req = makeRequest();
+    const slack = bridgeState.seedDelivery({
+      requestId: req.id,
+      destinationChannel: "slack",
+      destinationChatId: "C1",
+      destinationMessageId: "1.0",
+    });
+    const vellum = bridgeState.seedDelivery({
+      requestId: req.id,
+      destinationChannel: "vellum",
+      destinationConversationId: "conv-1",
+    });
+
+    const result = await withdrawGuardianRequestCards({
+      request: req,
+      status: "expired",
+    });
+
+    expect(result.complete).toBe(true);
+    const byId = new Map(deliveriesFor(req.id).map((d) => [d.id, d.status]));
+    expect(byId.get(slack.id)).toBe("withdrawn");
+    expect(byId.get(vellum.id)).toBe("withdrawn");
+  });
+
+  test("a retry skips rows already withdrawn: no re-edits, no re-broadcasts", async () => {
+    // The delivery row is the per-surface receipt. When one surface fails,
+    // the next round must retry only that surface; re-editing the others
+    // would re-broadcast in-app completions and re-run channel edits that
+    // already landed.
+    const req = makeRequest({ sourceChannel: "telegram" });
+    const slack = bridgeState.seedDelivery({
+      requestId: req.id,
+      destinationChannel: "slack",
+      destinationChatId: "C1",
+      destinationMessageId: "1.0",
+    });
+    const telegram = bridgeState.seedDelivery({
+      requestId: req.id,
+      destinationChannel: "telegram",
+      destinationChatId: "T1",
+      destinationMessageId: "9",
+    });
+    withdrawTelegramApprovalCard.mockResolvedValueOnce({ complete: false });
+
+    const first = await withdrawGuardianRequestCards({
+      request: req,
+      status: "expired",
+    });
+    expect(first.complete).toBe(false);
+    let byId = new Map(deliveriesFor(req.id).map((d) => [d.id, d.status]));
+    expect(byId.get(slack.id)).toBe("withdrawn");
+    expect(byId.get(telegram.id)).not.toBe("withdrawn");
+
+    const second = await withdrawGuardianRequestCards({
+      request: req,
+      status: "expired",
+    });
+    expect(second.complete).toBe(true);
+    byId = new Map(deliveriesFor(req.id).map((d) => [d.id, d.status]));
+    expect(byId.get(telegram.id)).toBe("withdrawn");
+    // The already-receipted Slack surface was not re-edited.
+    expect(withdrawSlackApprovalCard).toHaveBeenCalledTimes(1);
+    expect(withdrawTelegramApprovalCard).toHaveBeenCalledTimes(2);
+  });
+});
 describe("recordApprovalCardDelivery", () => {
   beforeEach(() => {
     bridgeState.reset();
@@ -582,6 +797,85 @@ describe("recordGuardianRequestDeliveries", () => {
     expect(delivery.destinationChatId).toBeNull();
   });
 
+  test("re-runs withdrawal when the request resolved before its rows were recorded", async () => {
+    // Recording happens after the notification pipeline settles, so a
+    // guardian acting the moment the card lands can resolve the request
+    // before any delivery row exists; that decision's withdrawal pass finds
+    // nothing. The recorder reconciles by withdrawing what it just recorded.
+    const req = makeRequest({
+      kind: "tool_approval",
+      toolName: "shell",
+      status: "approved",
+    });
+
+    await recordGuardianRequestDeliveries({
+      requestId: req.id,
+      deliveryResults: [
+        {
+          channel: "slack",
+          destination: "C999",
+          status: "sent",
+          messageId: "1700000000.1234",
+          conversationId: "conv-dm",
+        },
+      ],
+    });
+
+    expect(withdrawSlackApprovalCard).toHaveBeenCalledTimes(1);
+    const [delivery] = deliveriesFor(req.id);
+    expect(delivery.status).toBe("withdrawn");
+  });
+
+  test("leaves rows of a still-pending request alone after recording", async () => {
+    const req = makeRequest({ kind: "tool_approval", toolName: "shell" });
+    await recordGuardianRequestDeliveries({
+      requestId: req.id,
+      deliveryResults: [
+        {
+          channel: "slack",
+          destination: "C999",
+          status: "sent",
+          messageId: "1700000000.1234",
+        },
+      ],
+    });
+
+    expect(withdrawSlackApprovalCard).not.toHaveBeenCalled();
+    const [delivery] = deliveriesFor(req.id);
+    expect(delivery.status).toBe("sent");
+  });
+
+  test("a late status patch cannot resurrect a withdrawn vellum row", async () => {
+    // The pre-created vellum row can be withdrawn by a fast decision while
+    // the broadcast is still settling; the recorder's sent patch must not
+    // overwrite that receipt (mirrors the gateway store's sticky rule).
+    const req = makeRequest({ status: "approved" });
+    const pre = await recordApprovalCardDelivery({
+      requestId: req.id,
+      channel: "vellum",
+      conversationId: "conv-1",
+    });
+    await bridgeState.module.updateGuardianRequestDelivery(pre!.id, {
+      status: "withdrawn",
+    });
+
+    await recordGuardianRequestDeliveries({
+      requestId: req.id,
+      deliveryResults: [
+        {
+          channel: "vellum",
+          destination: "",
+          status: "sent",
+          conversationId: "conv-1",
+        },
+      ],
+      vellumDeliveryId: pre?.id,
+    });
+
+    const [delivery] = deliveriesFor(req.id);
+    expect(delivery.status).toBe("withdrawn");
+  });
+
   test("records a Slack delivery the withdrawal path can then edit in place", async () => {
     const req = makeRequest();
     await recordGuardianRequestDeliveries({

package/src/__tests__/guardian-expiry-notifier.test.ts

@@ -38,35 +38,49 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
   },
 }));
 
-// The sweep withdraws cards via this module; we only assert it is invoked, and
-// mocking it keeps the sweep import light (no surface/slack transitive deps).
+// The sweep withdraws cards via this module; mocking it keeps the sweep
+// import light (no surface/slack transitive deps). The completeness result
+// gates the sweep's expire confirmation.
 let withdrawCalls = 0;
+let withdrawIncomplete = false;
 mock.module("../approvals/guardian-card-withdrawal.js", () => ({
   withdrawGuardianRequestCards: async () => {
     withdrawCalls++;
+    return { complete: !withdrawIncomplete };
   },
 }));
 
-// Gateway guardian-request client — in-memory rows driven by tests. The sweep
-// asks the gateway to CAS-expire past-deadline pending rows and fans out
-// notifications from the returned rows.
+// Gateway guardian-request client, in-memory rows driven by tests. The
+// sweep lists past-deadline pending rows read-only and confirms each with
+// the per-request expire CAS after its side effects run.
 const gatewayRequests = new Map<string, GuardianRequestWire>();
+let expireCasFails = false;
+const actualGatewayGuardianRequests =
+  await import("../channels/gateway-guardian-requests.js");
 mock.module("../channels/gateway-guardian-requests.js", () => ({
-  sweepExpiredGuardianRequests: async () => {
+  ...actualGatewayGuardianRequests,
+  listExpiredPendingGuardianRequests: async () => {
     const now = Date.now();
-    const expired: GuardianRequestWire[] = [];
+    const stale: GuardianRequestWire[] = [];
     for (const row of gatewayRequests.values()) {
       if (
         row.status === "pending" &&
         row.expiresAt !== null &&
         row.expiresAt <= now
       ) {
-        const flipped = { ...row, status: "expired" as const };
-        gatewayRequests.set(row.id, flipped);
-        expired.push(flipped);
+        stale.push(row);
       }
     }
-    return expired;
+    return stale;
+  },
+  expireGuardianRequest: async (id: string) => {
+    if (expireCasFails) {
+      throw new Error("simulated IPC timeout");
+    }
+    const row = gatewayRequests.get(id);
+    if (row?.status === "pending") {
+      gatewayRequests.set(id, { ...row, status: "expired" as const });
+    }
   },
 }));
 
@@ -117,6 +131,9 @@ beforeEach(() => {
   broadcasts.length = 0;
   deliveryError = null;
   withdrawCalls = 0;
+  withdrawIncomplete = false;
+  expireCasFails = false;
+  gatewayRequests.clear();
   pendingInteractions.clear();
 });
 
@@ -229,7 +246,7 @@ describe("notifyExpiredGuardianRequest", () => {
     expect(deliveredReplies).toHaveLength(0);
   });
 
-  test("delivery failure is swallowed (best-effort)", async () => {
+  test("delivery failure never throws, and reports incomplete", async () => {
     deliveryError = new Error("gateway down");
 
     await expect(
@@ -240,7 +257,7 @@ describe("notifyExpiredGuardianRequest", () => {
           requesterChatId: "tg-chat",
         }),
       ),
-    ).resolves.toBeUndefined();
+    ).resolves.toEqual({ complete: false });
   });
 });
 
@@ -291,4 +308,91 @@ describe("sweep integration", () => {
     expect(gatewayRequests.get("req-fresh")?.status).toBe("pending");
     expect(deliveredReplies).toHaveLength(0);
   });
+
+  test("an incomplete withdrawal defers the request and holds the notice back", async () => {
+    // A card edit that failed leaves an actionable control somewhere, so the
+    // request must stay pending and retryable. The notice is held back too:
+    // sending it only after withdrawal completes means the retry round can
+    // never duplicate a delivered notice.
+    gatewayRequests.set(
+      "req-withdraw-fail",
+      makeRequest({
+        id: "req-withdraw-fail",
+        kind: "access_request",
+        status: "pending",
+        requesterChatId: "tg-chat",
+        requesterExternalUserId: "tg-user",
+        expiresAt: Date.now() - 1000,
+      }),
+    );
+
+    withdrawIncomplete = true;
+    expect(await runGuardianExpirySweep()).toBe(0);
+    expect(gatewayRequests.get("req-withdraw-fail")?.status).toBe("pending");
+    expect(deliveredReplies).toHaveLength(0);
+
+    withdrawIncomplete = false;
+    expect(await runGuardianExpirySweep()).toBe(1);
+    expect(gatewayRequests.get("req-withdraw-fail")?.status).toBe("expired");
+    expect(deliveredReplies).toHaveLength(1);
+  });
+
+  test("a failed requester notice defers the request until a retry delivers it", async () => {
+    gatewayRequests.set(
+      "req-notice-fail",
+      makeRequest({
+        id: "req-notice-fail",
+        kind: "access_request",
+        status: "pending",
+        requesterChatId: "tg-chat",
+        requesterExternalUserId: "tg-user",
+        expiresAt: Date.now() - 1000,
+      }),
+    );
+
+    deliveryError = new Error("channel briefly unreachable");
+    expect(await runGuardianExpirySweep()).toBe(0);
+    expect(gatewayRequests.get("req-notice-fail")?.status).toBe("pending");
+    expect(deliveredReplies).toHaveLength(0);
+
+    deliveryError = null;
+    expect(await runGuardianExpirySweep()).toBe(1);
+    expect(gatewayRequests.get("req-notice-fail")?.status).toBe("expired");
+    // The notice lands exactly once: the failed attempt delivered nothing.
+    expect(deliveredReplies).toHaveLength(1);
+  });
+
+  test("a lost expire confirmation leaves the row pending, and the next round recovers it", async () => {
+    // The status flip is the receipt that side effects ran, not the
+    // announcement that they should. When the confirmation is lost, the row
+    // must stay in the pending set so the next round re-runs its fan-out;
+    // the cost is at-least-once side effects, never their silent loss.
+    gatewayRequests.set(
+      "req-lost",
+      makeRequest({
+        id: "req-lost",
+        kind: "access_request",
+        status: "pending",
+        requesterChatId: "tg-chat",
+        requesterExternalUserId: "tg-user",
+        expiresAt: Date.now() - 1000,
+      }),
+    );
+
+    expireCasFails = true;
+    expect(await runGuardianExpirySweep()).toBe(0);
+    expect(gatewayRequests.get("req-lost")?.status).toBe("pending");
+    expect(withdrawCalls).toBe(1);
+    expect(deliveredReplies).toHaveLength(1);
+
+    expireCasFails = false;
+    expect(await runGuardianExpirySweep()).toBe(1);
+    expect(gatewayRequests.get("req-lost")?.status).toBe("expired");
+    // The re-run repeats the side effects (at-least-once); the third round
+    // finds nothing.
+    expect(withdrawCalls).toBe(2);
+    expect(deliveredReplies).toHaveLength(2);
+    expect(await runGuardianExpirySweep()).toBe(0);
+    expect(withdrawCalls).toBe(2);
+  });
 });

package/src/__tests__/guardian-gateway-sim.test.ts

@@ -0,0 +1,119 @@
+import { describe, expect, test } from "bun:test";
+
+import { createGuardianGatewaySim } from "./guardian-gateway-sim.js";
+
+import "./test-preload.js";
+
+/**
+ * Pins the simulator to the gateway's authorization-lifecycle contract.
+ * Fifteen assistant suites prove behavior against this sim, so a sim whose
+ * semantics drift from the gateway's lets them pass against a production
+ * shape that does not exist.
+ */
+describe("guardian gateway sim: boot expiry contract", () => {
+  test("expires only interaction-bound kinds, never persistent kinds", async () => {
+    const sim = createGuardianGatewaySim();
+    const past = Date.now() - 60_000;
+    sim.seedRequest({ id: "ta", kind: "tool_approval", status: "pending" });
+    sim.seedRequest({
+      id: "pq",
+      kind: "pending_question",
+      status: "pending",
+    });
+    // Past-deadline persistent rows stay pending for the sweep, which owns
+    // the card-withdrawal and requester-notice fan-out; boot must not
+    // pre-empt it (the gateway contract this sim mirrors).
+    sim.seedRequest({
+      id: "ar",
+      kind: "access_request",
+      status: "pending",
+      expiresAt: past,
+    });
+    sim.seedRequest({
+      id: "tg",
+      kind: "tool_grant_request",
+      status: "pending",
+      expiresAt: past,
+    });
+
+    const expired = await sim.module.expireInteractionBoundGuardianRequests();
+
+    expect(expired).toBe(2);
+    expect(sim.getRequest("ta")?.status).toBe("expired");
+    expect(sim.getRequest("pq")?.status).toBe("expired");
+    expect(sim.getRequest("ar")?.status).toBe("pending");
+    expect(sim.getRequest("tg")?.status).toBe("pending");
+  });
+});
+
+describe("guardian gateway sim: decision arbitration contract", () => {
+  test("a decision past the deadline loses atomically", async () => {
+    const sim = createGuardianGatewaySim();
+    sim.seedRequest({
+      id: "late",
+      kind: "access_request",
+      status: "pending",
+      expiresAt: Date.now() - 1000,
+    });
+
+    const result = await sim.module.decideGuardianRequest({
+      id: "late",
+      expectedStatus: "pending",
+      status: "approved",
+    });
+
+    expect(result.applied).toBe(false);
+    expect(sim.getRequest("late")?.status).toBe("pending");
+  });
+
+  test("a no-op expire never restamps a decided request's deliveries", async () => {
+    const sim = createGuardianGatewaySim();
+    sim.seedRequest({ id: "done", kind: "access_request", status: "pending" });
+    sim.seedDelivery({
+      id: "d1",
+      requestId: "done",
+      destinationChannel: "telegram",
+      destinationChatId: "chat-1",
+      status: "sent",
+    });
+    await sim.module.decideGuardianRequest({
+      id: "done",
+      expectedStatus: "pending",
+      status: "approved",
+    });
+
+    await sim.module.expireGuardianRequest("done");
+
+    expect(sim.getRequest("done")?.status).toBe("approved");
+    expect(sim.deliveries.find((d) => d.id === "d1")?.status).toBe("sent");
+  });
+
+  test("a withdrawn delivery keeps its receipt through the expire flip", async () => {
+    const sim = createGuardianGatewaySim();
+    sim.seedRequest({ id: "exp", kind: "access_request", status: "pending" });
+    sim.seedDelivery({
+      id: "kept",
+      requestId: "exp",
+      destinationChannel: "telegram",
+      destinationChatId: "chat-1",
+      status: "withdrawn",
+    });
+    sim.seedDelivery({
+      id: "flipped",
+      requestId: "exp",
+      destinationChannel: "vellum",
+      destinationConversationId: "conv-1",
+      status: "sent",
+    });
+
+    await sim.module.expireGuardianRequest("exp");
+
+    expect(sim.getRequest("exp")?.status).toBe("expired");
+    expect(sim.deliveries.find((d) => d.id === "kept")?.status).toBe(
+      "withdrawn",
+    );
+    expect(sim.deliveries.find((d) => d.id === "flipped")?.status).toBe(
+      "expired",
+    );
+  });
+});