@vellumai/assistant 0.12.0-staging.1 → 0.12.0

package/src/__tests__/conversation-queue.test.ts

@@ -450,6 +450,17 @@ async function waitForCondition(
   }
 }
 
+/** Count the history reloads a conversation performs from this point on. */
+function countHistoryReloads(conversation: Conversation): () => number {
+  const originalLoad = conversation.loadFromDb.bind(conversation);
+  let reloads = 0;
+  conversation.loadFromDb = async () => {
+    reloads++;
+    return originalLoad();
+  };
+  return () => reloads;
+}
+
 /**
  * Resolve the Nth pending AgentLoop.run() call. Fires the minimal events
  * that `runAgentLoop` expects (usage + message_complete) so the conversation
@@ -715,6 +726,292 @@ describe("Conversation message queue", () => {
     await new Promise((r) => setTimeout(r, 10));
   });
 
+  test("a drained turn commits its sender as the resting actor and re-scopes history", async () => {
+    // A contact's channel turn leaves the resting slot, and the resident
+    // history scoped from it, naming the contact. The guardian's message
+    // queued behind that turn must run as the guardian everywhere the slot is
+    // read, not only in the per-turn snapshot: the `<turn_context>` actor
+    // section is derived at turn start and history is scoped from the slot,
+    // so a drain that stamped only the snapshot rendered the guardian's own
+    // web turn as a trusted contact's and hid the guardian's rows from it.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    const guardian = {
+      trustClass: "guardian" as const,
+      sourceChannel: "vellum" as const,
+      requesterExternalUserId: "guardian-principal",
+    };
+    const reloads = countHistoryReloads(conversation);
+    conversation.enqueueMessage({
+      content: "msg-2",
+      requestId: "req-2",
+      trustContext: guardian,
+    });
+
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+
+    // Read while run 2 is in flight: the slot, the snapshot, and the frozen
+    // actor section all describe the guardian, and the history was reloaded
+    // for that scope exactly once.
+    expect(conversation.getTrustContext()).toBe(guardian);
+    expect(conversation.currentTurnTrustContext).toBe(guardian);
+    expect(conversation.currentTurnInboundActorContext).toBeNull();
+    expect(reloads()).toBe(1);
+
+    await resolveRun(1);
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
+  test("a batched drain commits the head's sender as the resting actor", async () => {
+    // Same commitment on the batched path, which coalesces only messages that
+    // share a trust identity, so the head's sender is the batch's actor.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    const guardian = {
+      trustClass: "guardian" as const,
+      sourceChannel: "vellum" as const,
+      requesterExternalUserId: "guardian-principal",
+    };
+    const reloads = countHistoryReloads(conversation);
+    conversation.enqueueMessage({
+      content: "msg-2",
+      requestId: "req-2",
+      trustContext: guardian,
+    });
+    conversation.enqueueMessage({
+      content: "msg-3",
+      requestId: "req-3",
+      trustContext: guardian,
+    });
+
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+
+    // One batched run for both siblings, committed as the guardian.
+    expect(pendingRuns.length).toBe(2);
+    expect(conversation.getTrustContext()).toBe(guardian);
+    expect(conversation.currentTurnTrustContext).toBe(guardian);
+    expect(conversation.currentTurnInboundActorContext).toBeNull();
+    expect(reloads()).toBe(1);
+
+    await resolveRun(1);
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
+  test("a drained turn keeps its sender when the slot moves during the history reload", async () => {
+    // The commit captures the sender before the reload awaits. A writer that
+    // moves the slot inside that await (a wake's stamp, a pointer elevation)
+    // must not become the turn's actor: the history was reloaded for the
+    // sender, and running someone else's trust over it is the escalation.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    const guardian = {
+      trustClass: "guardian" as const,
+      sourceChannel: "vellum" as const,
+      requesterExternalUserId: "guardian-principal",
+    };
+    const intruder = {
+      trustClass: "unknown" as const,
+      sourceChannel: "telegram" as const,
+      requesterExternalUserId: "T-stranger",
+    };
+    conversation.enqueueMessage({
+      content: "msg-2",
+      requestId: "req-2",
+      trustContext: guardian,
+    });
+
+    // The drain's reload is the await the writer lands inside.
+    const originalLoad = conversation.loadFromDb.bind(conversation);
+    let movedDuringReload = false;
+    conversation.loadFromDb = async () => {
+      const result = await originalLoad();
+      conversation.setTrustContext(intruder);
+      movedDuringReload = true;
+      return result;
+    };
+
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+
+    expect(movedDuringReload).toBe(true);
+    expect(conversation.getTrustContext()).toBe(intruder);
+    expect(conversation.currentTurnTrustContext).toBe(guardian);
+    expect(conversation.currentTurnInboundActorContext).toBeNull();
+
+    await resolveRun(1);
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
+  test("a drain whose history reload fails puts the resting actor back", async () => {
+    // A reload that fails starts no turn: the message is requeued for the
+    // next drain, so the slot must not keep naming a sender whose turn never
+    // began, or conversation-level readers report an owner that is not there.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    const contact = {
+      trustClass: "trusted_contact" as const,
+      sourceChannel: "slack" as const,
+      requesterExternalUserId: "U-contact",
+    };
+    conversation.setTrustContext(contact);
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    const guardian = {
+      trustClass: "guardian" as const,
+      sourceChannel: "vellum" as const,
+      requesterExternalUserId: "guardian-principal",
+    };
+    conversation.enqueueMessage({
+      content: "msg-2",
+      requestId: "req-2",
+      trustContext: guardian,
+    });
+
+    let reloadAttempts = 0;
+    conversation.loadFromDb = async () => {
+      reloadAttempts++;
+      throw new Error("history store exploded");
+    };
+
+    // Finish the first turn; the drain (and its one retry) fail on the reload.
+    await resolveRun(0);
+    await p1;
+    await waitForCondition(() => reloadAttempts >= 2);
+    await new Promise((r) => setTimeout(r, 20));
+
+    expect(pendingRuns.length).toBe(1);
+    expect(conversation.getQueueDepth()).toBe(1);
+    expect(conversation.getTrustContext()).toBe(contact);
+  });
+
+  test("the turn-context actor section follows the turn's actor when the slot moves before the loop opens", async () => {
+    // The actor section is frozen at turn start from the turn's own actor,
+    // not from the resting slot. The drain stamps the slot and then awaits
+    // (persist) before the loop opens; an out-of-band writer landing in that
+    // window (pointer elevation restore, a wake's restore) moves the slot
+    // without owning the turn, and a read of the slot there would describe
+    // that writer's actor to the model.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    const contact = {
+      trustClass: "trusted_contact" as const,
+      sourceChannel: "slack" as const,
+      requesterExternalUserId: "U-contact",
+    };
+    conversation.setTrustContext(contact);
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    const guardian = {
+      trustClass: "guardian" as const,
+      sourceChannel: "vellum" as const,
+      requesterExternalUserId: "guardian-principal",
+    };
+    conversation.enqueueMessage({
+      content: "msg-2",
+      requestId: "req-2",
+      trustContext: guardian,
+    });
+
+    // Land the out-of-band slot write inside the drain's window, after its
+    // stamp and before the loop opens: the drain awaits persistUserMessage
+    // there. The resting slot alone is moved; the per-turn snapshot is the
+    // drain's to carry into the run.
+    const originalPersist = conversation.persistUserMessage.bind(conversation);
+    let slotMoved = false;
+    (
+      conversation as unknown as {
+        persistUserMessage: typeof conversation.persistUserMessage;
+      }
+    ).persistUserMessage = async (opts) => {
+      const result = await originalPersist(opts);
+      conversation.setTrustContext(contact);
+      slotMoved = true;
+      return result;
+    };
+
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+
+    // Guard the test itself: the injection must have run, and the slot must
+    // disagree with the turn, or the assertion below passes for the wrong
+    // reason.
+    expect(slotMoved).toBe(true);
+    expect(conversation.getTrustContext()).toBe(contact);
+    expect(conversation.currentTurnTrustContext).toBe(guardian);
+    // The guardian's turn renders no actor section, whatever the slot says.
+    expect(conversation.currentTurnInboundActorContext).toBeNull();
+
+    await resolveRun(1);
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
   test("a processMessage turn keeps its turn-start trust when the slot moves before the loop opens", async () => {
     // processMessage is the third turn entry point, and the one a web turn
     // takes on an idle conversation (the route only enqueues while

package/src/__tests__/credential-routes.test.ts

@@ -1,6 +1,6 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import { BadRequestError } from "../runtime/routes/errors.js";
+import { BadRequestError, ForbiddenError } from "../runtime/routes/errors.js";
 import type { CredentialMetadata } from "../tools/credentials/metadata-store.js";
 
 // ---------------------------------------------------------------------------
@@ -169,6 +169,9 @@ const setRoute = ROUTES.find((r) => r.operationId === "credentials_set");
 const listRoute = ROUTES.find((r) => r.operationId === "credentials_list");
 const deleteRoute = ROUTES.find((r) => r.operationId === "credentials_delete");
 const revealRoute = ROUTES.find((r) => r.operationId === "credentials_reveal");
+const inspectRoute = ROUTES.find(
+  (r) => r.operationId === "credentials_inspect",
+);
 
 type SetResponse = { credentialId: string; service: string; field: string };
 type ListResponse = {
@@ -591,16 +594,19 @@ describe("credentials routes", () => {
 
     test("non-secret vellum platform fields are stored but never scrubbed", async () => {
       /**
-       * Platform identity ids and the base URL are benign UUIDs/URLs that
-       * legitimately appear in transcripts; scrubbing them would redact
-       * ordinary conversation content. Shares the exemption with the
-       * /v1/secrets credential branch via isNonSecretPlatformField.
+       * Platform identity ids are benign UUIDs that legitimately appear in
+       * transcripts; scrubbing them would redact ordinary conversation
+       * content. Shares the exemption with the /v1/secrets credential branch
+       * via isNonSecretPlatformField.
+       *
+       * `platform_base_url` carries the same exemption but is not settable
+       * here: it decides which host receives the platform API key, so the
+       * credentials API refuses it (see the platform-managed suite).
        */
       for (const field of [
         "platform_assistant_id",
         "platform_organization_id",
         "platform_user_id",
-        "platform_base_url",
       ]) {
         const result = (await setRoute!.handler({
           body: {
@@ -795,6 +801,179 @@ describe("credentials routes", () => {
     });
   });
 
+  describe("platform-managed credentials", () => {
+    const PLATFORM_KEY = "vk-platform-provisioned-key";
+    const PLATFORM_BASE_URL = "https://platform.example";
+
+    /**
+     * The platform provisions the pod's own credentials by POSTing them to
+     * `/v1/secrets` as `credential` entries, which land in the same secure
+     * store and metadata table as a user's own credentials.
+     */
+    function seedPlatformCredential(field: string, value: string): string {
+      const key = `vellum:${field}`;
+      secureStore.set(key, value);
+      const now = Date.now();
+      metadataStore.set(key, {
+        credentialId: `cred-${++credentialIdCounter}`,
+        service: "vellum",
+        field,
+        allowedTools: [],
+        allowedDomains: [],
+        createdAt: now,
+        updatedAt: now,
+      });
+      return metadataStore.get(key)!.credentialId;
+    }
+
+    test("the listing omits platform credentials and keeps the user's own", async () => {
+      // GIVEN the platform's provisioned credentials alongside a user's
+      seedPlatformCredential("assistant_api_key", PLATFORM_KEY);
+      seedPlatformCredential("platform_base_url", PLATFORM_BASE_URL);
+      await setRoute!.handler({
+        body: { service: "vercel", field: "api_token", value: SECRET_VALUE },
+      });
+
+      // WHEN the credentials are listed
+      const result = (await listRoute!.handler({ body: {} })) as ListResponse;
+
+      // THEN only the user's credential is a row, and no platform value leaks
+      expect(result.credentials.map((c) => `${c.service}:${c.field}`)).toEqual([
+        "vercel:api_token",
+      ]);
+      expect(JSON.stringify(result)).not.toContain(PLATFORM_KEY);
+    });
+
+    test("reveal refuses the platform API key for every principal", async () => {
+      /**
+       * Both farming paths land on this handler: the assistant's own tool
+       * shell arrives as `local`, a Settings click as `user`.
+       */
+      seedPlatformCredential("assistant_api_key", PLATFORM_KEY);
+
+      for (const principal of ["local", "user", "svc_gateway"]) {
+        await expect(
+          revealRoute!.handler({
+            body: { service: "vellum", field: "assistant_api_key" },
+            headers: { "x-vellum-principal-type": principal },
+          }),
+        ).rejects.toThrow(ForbiddenError);
+      }
+    });
+
+    test("reveal refuses a platform credential looked up by UUID", async () => {
+      const credentialId = seedPlatformCredential(
+        "assistant_api_key",
+        PLATFORM_KEY,
+      );
+
+      await expect(
+        revealRoute!.handler({
+          body: { id: credentialId },
+          headers: { "x-vellum-principal-type": "local" },
+        }),
+      ).rejects.toThrow(/owned by the Vellum platform/);
+    });
+
+    test("inspect refuses platform credentials", async () => {
+      seedPlatformCredential("assistant_api_key", PLATFORM_KEY);
+      seedPlatformCredential("platform_base_url", PLATFORM_BASE_URL);
+
+      for (const field of ["assistant_api_key", "platform_base_url"]) {
+        await expect(
+          inspectRoute!.handler({
+            body: { service: "vellum", field },
+          }),
+        ).rejects.toThrow(ForbiddenError);
+      }
+    });
+
+    test("set refuses platform credentials", async () => {
+      /**
+       * A write is a read by another name: repointing `platform_base_url`
+       * sends the next platform call, bearing the API key, to a host the
+       * writer chose. The platform's own provisioning does not come through
+       * this route; it writes over `POST /v1/secrets`.
+       */
+      for (const field of ["assistant_api_key", "platform_base_url"]) {
+        await expect(
+          setRoute!.handler({
+            body: { service: "vellum", field, value: "https://attacker.test" },
+          }),
+        ).rejects.toThrow(ForbiddenError);
+      }
+
+      expect(secureStore.has("vellum:assistant_api_key")).toBe(false);
+      expect(secureStore.has("vellum:platform_base_url")).toBe(false);
+    });
+
+    test("set does not overwrite an already-provisioned platform credential", async () => {
+      seedPlatformCredential("platform_base_url", PLATFORM_BASE_URL);
+
+      await expect(
+        setRoute!.handler({
+          body: {
+            service: "vellum",
+            field: "platform_base_url",
+            value: "https://attacker.test",
+          },
+        }),
+      ).rejects.toThrow(/owned by the Vellum platform/);
+
+      expect(secureStore.get("vellum:platform_base_url")).toBe(
+        PLATFORM_BASE_URL,
+      );
+    });
+
+    test("delete refuses platform credentials", async () => {
+      seedPlatformCredential("assistant_api_key", PLATFORM_KEY);
+      seedPlatformCredential("platform_base_url", PLATFORM_BASE_URL);
+
+      for (const field of ["assistant_api_key", "platform_base_url"]) {
+        await expect(
+          deleteRoute!.handler({ body: { service: "vellum", field } }),
+        ).rejects.toThrow(ForbiddenError);
+      }
+
+      expect(secureStore.get("vellum:assistant_api_key")).toBe(PLATFORM_KEY);
+      expect(secureStore.get("vellum:platform_base_url")).toBe(
+        PLATFORM_BASE_URL,
+      );
+    });
+
+    test("a user credential is still writable and deletable", async () => {
+      const stored = (await setRoute!.handler({
+        body: { service: "vercel", field: "api_token", value: SECRET_VALUE },
+      })) as SetResponse;
+      expect(stored.service).toBe("vercel");
+      expect(secureStore.get("vercel:api_token")).toBe(SECRET_VALUE);
+
+      const deleted = (await deleteRoute!.handler({
+        body: { service: "vercel", field: "api_token" },
+      })) as DeleteResponse;
+      expect(deleted.field).toBe("api_token");
+      expect(secureStore.has("vercel:api_token")).toBe(false);
+    });
+
+    test("a user credential still inspects and reveals", async () => {
+      seedPlatformCredential("assistant_api_key", PLATFORM_KEY);
+      await setRoute!.handler({
+        body: { service: "vercel", field: "api_token", value: SECRET_VALUE },
+      });
+
+      const inspected = (await inspectRoute!.handler({
+        body: { service: "vercel", field: "api_token" },
+      })) as { scrubbedValue: string };
+      expect(inspected.scrubbedValue).toBe("supe****");
+
+      const revealed = (await revealRoute!.handler({
+        body: { service: "vercel", field: "api_token" },
+        headers: { "x-vellum-principal-type": "user" },
+      })) as { value: string };
+      expect(revealed.value).toBe(SECRET_VALUE);
+    });
+  });
+
   describe("credentials_delete", () => {
     test("removes the secret and metadata and echoes the identifiers", async () => {
       /**

package/src/__tests__/drain-kick-guard.test.ts

@@ -79,6 +79,8 @@ function makeFakeConversation(
     getTurnInterfaceContext: () => null,
     setTurnInterfaceContext: () => {},
     setTransportHints: () => {},
+    setTrustContext: () => {},
+    ensureActorScopedHistory: async () => {},
     emitActivityState: () => {
       if (activityFailures > 0) {
         activityFailures -= 1;

package/src/__tests__/drain-requeue-on-contention.test.ts

@@ -78,6 +78,12 @@ function makeFakeConversation(options: {
     setTransportHints: () => {
       mutationCalls.push("setTransportHints");
     },
+    setTrustContext: () => {
+      mutationCalls.push("setTrustContext");
+    },
+    ensureActorScopedHistory: async () => {
+      mutationCalls.push("ensureActorScopedHistory");
+    },
     emitActivityState: () => {
       mutationCalls.push("emitActivityState");
     },

package/src/__tests__/messaging-send-tool.test.ts

@@ -304,6 +304,48 @@ describe("messaging-send tool", () => {
     }
   });
 
+  test("records a threaded channel send in the thread's home, with the delivered thread on the row", async () => {
+    provider = slackProvider;
+    getConversationMock.mockImplementation(() => ({
+      id: "home-topic",
+      createdAt: 1700000000000,
+    }));
+    resolveProactiveHomeConversationMock.mockImplementation(async () => ({
+      conversationId: "home-topic",
+      createdNewConversation: false,
+    }));
+
+    const result = await run(
+      {
+        platform: "slack",
+        conversation_id: "C123",
+        thread_id: "1700000000.000009",
+        text: "hello from A",
+      },
+      {
+        workingDir: "/tmp",
+        conversationId: "conv-A",
+        assistantId: "ast-1",
+        trustClass: "guardian" as const,
+      },
+    );
+
+    expect(result.isError).toBe(false);
+    expect(
+      resolveProactiveHomeConversationMock.mock.calls[0]![0],
+    ).toMatchObject({
+      sourceChannel: "slack",
+      externalChatId: "C123",
+      threadId: "1700000000.000009",
+    });
+    expect(recordDeliveredChannelPostMock.mock.calls[0]![0]).toMatchObject({
+      conversationId: "home-topic",
+      externalChatId: "C123",
+      threadId: "1700000000.000009",
+      providerMessageId: "1700000000.000100",
+    });
+  });
+
   test("records a channel send in the chat's home conversation once the provider has it", async () => {
     provider = telegramProvider;
     getConversationMock.mockImplementation(() => ({

package/src/__tests__/oauth-commands-routes.test.ts

@@ -656,6 +656,53 @@ describe("POST oauth/request", () => {
     expect(result.body).toEqual({ hello: "world" });
   });
 
+  // The recovery hint on a 401/403 follows the credential's kind. A channel
+  // bot's token is stored by the channel's setup, so the OAuth status and
+  // connect commands cannot repair it; the hint must name the channel's own
+  // diagnostics, through whichever door the request came.
+  test("401 as a channel bot points at the channel's diagnostics, never the OAuth commands", async () => {
+    mockProviders.slack_channel = {
+      ...baseProvider,
+      provider: "slack_channel",
+      authorizeUrl: "urn:manual-token",
+      managedServiceConfigKey: null,
+      baseUrl: "https://slack.com/api",
+    };
+    mockResolveResponse = {
+      status: 401,
+      headers: { "content-type": "application/json" },
+      body: { ok: false, error: "invalid_auth" },
+    };
+    const result = (await getRoute("POST", "oauth/request").handler(
+      makeArgs({
+        body: { provider: "slack_channel", url: "/conversations.history" },
+      }),
+    )) as { ok: boolean; status: number; hint?: string };
+    expect(result.ok).toBe(false);
+    expect(result.status).toBe(401);
+    expect(result.hint).toContain("slack bot credential");
+    expect(result.hint).toContain("assistant channels get slack");
+    expect(result.hint).not.toContain("oauth status");
+    expect(result.hint).not.toContain("oauth connect");
+  });
+
+  test("403 as a person's OAuth integration keeps the OAuth recovery steps", async () => {
+    mockResolveResponse = {
+      status: 403,
+      headers: { "content-type": "application/json" },
+      body: { error: "forbidden" },
+    };
+    const result = (await getRoute("POST", "oauth/request").handler(
+      makeArgs({
+        body: { provider: "google", url: "https://api.google.com/v1/me" },
+      }),
+    )) as { ok: boolean; status: number; hint?: string };
+    expect(result.status).toBe(403);
+    expect(result.hint).toContain("assistant oauth status google");
+    expect(result.hint).toContain("oauth connect");
+    expect(result.hint).not.toContain("channels get");
+  });
+
   test("passes a pre-parsed string body through to the connection unchanged", async () => {
     const multipart =
       "--boundary\r\nContent-Type: application/json\r\n\r\n{}\r\n--boundary--\r\n";