@vellumai/assistant 0.12.0 → 0.12.1-dev.202609141913.5e16607

package/src/__tests__/cu-unified-flow.test.ts

@@ -224,7 +224,10 @@ describe("surfaceProxyResolver — CU tool routing", () => {
       );
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain("no desktop client connected");
+      expect(result.content).toContain(
+        "The Vellum desktop app is needed to view or control your screen",
+      );
+      expect(result.content).toContain("https://www.vellum.ai/downloads");
     });
 
     test("returns error when proxy exists but client not connected", async () => {
@@ -237,7 +240,10 @@ describe("surfaceProxyResolver — CU tool routing", () => {
       });
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain("no desktop client connected");
+      expect(result.content).toContain(
+        "The Vellum desktop app is needed to view or control your screen",
+      );
+      expect(result.content).toContain("https://www.vellum.ai/downloads");
       proxyObj.dispose();
     });
 

package/src/__tests__/document-sync-tags.test.ts

@@ -143,6 +143,31 @@ describe("document write routes publish documents:list", () => {
     expectDocumentsChanged(events);
   });
 
+  test("an existing document with a missing conversation can save before relinking", async () => {
+    await saveViaRoute();
+    const db = getDb();
+    db.run("PRAGMA foreign_keys = OFF");
+    try {
+      db.run("DELETE FROM conversations");
+    } finally {
+      db.run("PRAGMA foreign_keys = ON");
+    }
+
+    await expect(
+      saveViaRoute({ title: "Renamed notes", content: "Edited body" }),
+    ).resolves.toMatchObject({ success: true, surfaceId: "doc-sync" });
+    createConversation({ id: OTHER_CONVERSATION_ID });
+    await expect(
+      linkViaRoute("doc-sync", OTHER_CONVERSATION_ID),
+    ).resolves.toMatchObject({ success: true });
+    await expect(
+      invoke("getDocument", { pathParams: { id: "doc-sync" } }),
+    ).resolves.toMatchObject({
+      title: "Renamed notes",
+      content: "Edited body",
+    });
+  });
+
   test("a content-only save publishes", async () => {
     // The save moves `updated_at` and the word count, which order and fill the
     // Library and the assets list on every other client. The saving client

package/src/__tests__/drain-kick-guard.test.ts

@@ -79,8 +79,6 @@ function makeFakeConversation(
     getTurnInterfaceContext: () => null,
     setTurnInterfaceContext: () => {},
     setTransportHints: () => {},
-    setTrustContext: () => {},
-    ensureActorScopedHistory: async () => {},
     emitActivityState: () => {
       if (activityFailures > 0) {
         activityFailures -= 1;

package/src/__tests__/drain-requeue-on-contention.test.ts

@@ -78,12 +78,6 @@ function makeFakeConversation(options: {
     setTransportHints: () => {
       mutationCalls.push("setTransportHints");
     },
-    setTrustContext: () => {
-      mutationCalls.push("setTrustContext");
-    },
-    ensureActorScopedHistory: async () => {
-      mutationCalls.push("ensureActorScopedHistory");
-    },
     emitActivityState: () => {
       mutationCalls.push("emitActivityState");
     },

package/src/__tests__/evict-conversations-for-reload.test.ts

@@ -1,6 +1,6 @@
 /**
  * `evictConversationsForReload` drops in-memory conversations after a
- * config/prompt/skills reload so the next turn rebuilds them against the new
+ * config/prompt reload so the next turn rebuilds them against the new
  * config. Queued messages live only on the instance being disposed, so the
  * same "not idle while a queue is pending" rule the periodic evictor applies
  * has to hold here: `isProcessing()` reads false in the window between a turn

package/src/__tests__/git-porcelain.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  collectDirtyPathsFromPorcelain,
+  parsePorcelainZ,
+} from "../workspace/git-porcelain.js";
+
+describe("parsePorcelainZ", () => {
+  test("parses ordinary modified and untracked records", () => {
+    expect(parsePorcelainZ("M  tracked.txt\0?? new.txt\0")).toEqual([
+      { status: "M ", path: "tracked.txt" },
+      { status: "??", path: "new.txt" },
+    ]);
+  });
+
+  test("captures rename origin on the same record", () => {
+    expect(parsePorcelainZ("R  dest.txt\0src.txt\0")).toEqual([
+      { status: "R ", path: "dest.txt", origin: "src.txt" },
+    ]);
+  });
+
+  test("captures copy origin on the same record", () => {
+    expect(parsePorcelainZ("C  dest.txt\0src.txt\0")).toEqual([
+      { status: "C ", path: "dest.txt", origin: "src.txt" },
+    ]);
+  });
+
+  test("skips short leftover NUL entries", () => {
+    expect(parsePorcelainZ("M  a.txt\0\0")).toEqual([
+      { status: "M ", path: "a.txt" },
+    ]);
+  });
+});
+
+describe("collectDirtyPathsFromPorcelain", () => {
+  test("flattens rename origin so both paths are staged", () => {
+    expect(
+      collectDirtyPathsFromPorcelain("R  dest.txt\0src.txt\0?? extra.txt\0"),
+    ).toEqual(["dest.txt", "src.txt", "extra.txt"]);
+  });
+
+  test("dedupes a path that appears as both origin and destination", () => {
+    expect(collectDirtyPathsFromPorcelain("R  same.txt\0same.txt\0")).toEqual([
+      "same.txt",
+    ]);
+  });
+});

package/src/__tests__/helpers/set-workspace-mcp.ts

@@ -0,0 +1,11 @@
+/**
+ * Seed `$VELLUM_WORKSPACE_DIR/mcp.json` for tests that go through the
+ * real workspace MCP loader.
+ */
+
+import type { McpConfig } from "../../config/schemas/mcp.js";
+import { saveWorkspaceMcpConfig } from "../../mcp/workspace-mcp-config.js";
+
+export function setWorkspaceMcp(servers: McpConfig["servers"]): void {
+  saveWorkspaceMcpConfig({ servers });
+}

package/src/__tests__/host-bash-proxy.test.ts

@@ -669,23 +669,31 @@ describe("HostBashProxy", () => {
       expect(sentMessages).toHaveLength(0);
     });
 
-    test("rejects ambiguously when multiple same-user capable clients are connected and no targetClientId", async () => {
-      // Regression: previously fell through to untargeted broadcast, fanning
-      // a single targeted-style request out across every same-user machine.
+    test("selects the most recently active same-user client when several are connected", async () => {
       setup();
       setupMultipleClients(["client-1", "client-2", "client-3"]);
 
-      const result = await proxy.request(
+      const resultPromise = proxy.request(
         { command: "echo hello" },
         "session-1",
         undefined,
         "user-A",
       );
 
-      expect(result.isError).toBe(true);
-      expect(result.content).toContain("target_client_id");
-      // No broadcast happened
-      expect(sentMessages).toHaveLength(0);
+      const sent = sentMessages[0] as Record<string, unknown>;
+      expect(sent.targetClientId).toBe("client-1");
+      const options = sentMessageOptions[0] as
+        | Record<string, unknown>
+        | undefined;
+      expect(options?.targetClientId).toBe("client-1");
+
+      proxy.resolveResult(sent.requestId as string, {
+        stdout: "hello\n",
+        stderr: "",
+        exitCode: 0,
+        timedOut: false,
+      });
+      expect((await resultPromise).isError).toBe(false);
     });
 
     test("falls through to broadcast when zero capable clients (existing timeout path)", async () => {
@@ -832,30 +840,19 @@ describe("HostBashProxy", () => {
       expect(sentMessages).toHaveLength(0);
     });
 
-    test("untargeted local flow unchanged when no auto-resolve match", async () => {
+    test("rejects when the actor has no capable client", async () => {
       setup();
-      // No capable clients connected — untargeted path runs.
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { command: "echo hello" },
         "session-1",
         undefined,
         "user-A",
       );
 
-      expect(sentMessages).toHaveLength(1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.type).toBe("host_bash_request");
-      expect(sent.targetClientId).toBeUndefined();
-
-      const requestId = sent.requestId as string;
-      proxy.resolveResult(requestId, {
-        stdout: "hello\n",
-        stderr: "",
-        exitCode: 0,
-        timedOut: false,
-      });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
 
     test("auto-resolve to same-user client succeeds", async () => {
@@ -883,36 +880,20 @@ describe("HostBashProxy", () => {
       await resultPromise;
     });
 
-    test("auto-resolve to different-user client falls through to untargeted", async () => {
+    test("rejects when only a different user has a capable client", async () => {
       setup();
-      // Single capable client owned by user-B; caller is user-A.
       setupSingleClient("client-abc", "user-B");
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { command: "echo hello" },
         "session-1",
         undefined,
         "user-A",
       );
 
-      // Auto-resolve must NOT pick the cross-user client; the untargeted
-      // broadcast path runs instead.
-      expect(sentMessages).toHaveLength(1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.type).toBe("host_bash_request");
-      expect(sent.targetClientId).toBeUndefined();
-
-      const opts = sentMessageOptions[0] as Record<string, unknown> | undefined;
-      expect(opts?.targetClientId).toBeUndefined();
-
-      const requestId = sent.requestId as string;
-      proxy.resolveResult(requestId, {
-        stdout: "hello\n",
-        stderr: "",
-        exitCode: 0,
-        timedOut: false,
-      });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
   });
 });

package/src/__tests__/host-browser-proxy.test.ts

@@ -608,22 +608,17 @@ describe("HostBrowserProxy", () => {
         },
       ];
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { cdpMethod: "Page.navigate", cdpParams: { url: "https://a.test" } },
         "session-1",
         undefined,
         "user-1",
       );
 
-      // Auto-resolution filters out the cross-user candidate, so the
-      // proxy falls into the existing "no active extension connection"
-      // rejection — we never broadcast to a different actor's client.
-      await expect(resultPromise).rejects.toThrow(
-        "no active extension connection",
-      );
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
       expect(getPublishedMessages()).toHaveLength(0);
     });
-
     test("prefers the chrome-extension client over a more-recently-active macOS bridge", async () => {
       // Mock `listClientsByCapability` returns mockClients in array
       // order, which mirrors production's `lastActiveAt`-desc ordering.
@@ -720,11 +715,6 @@ describe("HostBrowserProxy", () => {
     });
 
     test("rejects when caller has actor but no host_browser-capable client is connected for that actor", async () => {
-      // Same-user filter returns empty even though listClientsByCapability
-      // would return a non-empty list (because that list is for a
-      // different actor). The unfiltered fallback path runs only when
-      // the caller has no actor — we don't silently broadcast to anyone
-      // when the caller IS authenticated to a specific actor.
       mockClients = [
         {
           clientId: "other-user-ext",
@@ -734,16 +724,15 @@ describe("HostBrowserProxy", () => {
         },
       ];
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { cdpMethod: "Page.navigate", cdpParams: { url: "https://a.test" } },
         "session-1",
         undefined,
         "user-1",
       );
 
-      await expect(resultPromise).rejects.toThrow(
-        "no active extension connection",
-      );
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
       expect(getPublishedMessages()).toHaveLength(0);
     });
   });

package/src/__tests__/host-file-proxy-targeted.test.ts

@@ -274,6 +274,29 @@ describe("HostFileProxy — targetClientId (Phase 2)", () => {
     });
   });
 
+  test("selects the most recently active same-user client when several are connected", async () => {
+    setup();
+    setupMultipleClients(["client-1", "client-2"]);
+
+    const resultPromise = proxy.request(
+      { operation: "read", path: "/tmp/file.txt" },
+      "session-1",
+      undefined,
+      undefined,
+      TEST_PRINCIPAL,
+    );
+
+    const sent = sentMessages[0] as Record<string, unknown>;
+    expect(sent.targetClientId).toBe("client-1");
+    const options = sentMessageOptions[0] as
+      | Record<string, unknown>
+      | undefined;
+    expect(options?.targetClientId).toBe("client-1");
+
+    proxy.resolve(sent.requestId as string, { content: "ok", isError: false });
+    expect((await resultPromise).isError).toBe(false);
+  });
+
   // ── targetClientId in cancel (abort signal) ──────────────────────────
 
   describe("targetClientId in cancel — abort signal", () => {

package/src/__tests__/host-file-proxy.test.ts

@@ -746,9 +746,8 @@ describe("HostFileProxy", () => {
       expect(sentMessages).toHaveLength(0);
     });
 
-    test("untargeted request with no auto-resolve match still broadcasts (legacy path unchanged)", async () => {
+    test("rejects when the actor has no capable client", async () => {
       setup();
-      // No matching same-user clients available.
       mockClients = [
         {
           clientId: "client-A",
@@ -757,23 +756,18 @@ describe("HostFileProxy", () => {
         },
       ];
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { operation: "read", path: "/tmp/test.txt" },
         "session-1",
         undefined,
         undefined,
-        "user-B", // No same-user match → no auto-resolve, broadcast untargeted.
+        "user-B",
       );
 
-      expect(sentMessages).toHaveLength(1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.targetClientId).toBeUndefined();
-      const requestId = sent.requestId as string;
-
-      proxy.resolve(requestId, { content: "ok", isError: false });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
-
     test("auto-resolve picks the same-user client when there's exactly one", async () => {
       setup();
       mockClients = [
@@ -807,7 +801,7 @@ describe("HostFileProxy", () => {
       await resultPromise;
     });
 
-    test("auto-resolve falls through when no client matches the source user", async () => {
+    test("rejects when only a different user has a capable client", async () => {
       setup();
       mockClients = [
         {
@@ -817,7 +811,7 @@ describe("HostFileProxy", () => {
         },
       ];
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { operation: "read", path: "/tmp/test.txt" },
         "session-1",
         undefined,
@@ -825,16 +819,10 @@ describe("HostFileProxy", () => {
         "user-C",
       );
 
-      // No same-user client → no auto-resolve, broadcast untargeted.
-      expect(sentMessages).toHaveLength(1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.targetClientId).toBeUndefined();
-      const requestId = sent.requestId as string;
-
-      proxy.resolve(requestId, { content: "ok", isError: false });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
-
     test("legacy embedded targetClientId in input still goes through the same-user gate", async () => {
       setup();
       mockClients = [

package/src/__tests__/host-transfer-proxy-targeted.test.ts

@@ -812,7 +812,7 @@ describe("HostTransferProxy — targetClientId", () => {
       await resultPromise;
     });
 
-    test("requestToHost: auto-resolve falls through when no client matches the source user", async () => {
+    test("requestToHost: rejects when no client matches the source user", async () => {
       setup();
       mockClientRegistry.set("client-A", {
         clientId: "client-A",
@@ -824,7 +824,7 @@ describe("HostTransferProxy — targetClientId", () => {
       const srcPath = `/tmp/htp-auto-no-match-${Date.now()}.txt`;
       await globalThis.Bun.write(srcPath, "data");
 
-      const resultPromise = proxy.requestToHost(
+      const result = await proxy.requestToHost(
         {
           sourcePath: srcPath,
           destPath: "/host/dest.txt",
@@ -835,13 +835,9 @@ describe("HostTransferProxy — targetClientId", () => {
         "user-C",
       );
 
-      await waitForMessages(sentMessages, 1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.targetClientId).toBeUndefined();
-
-      const requestId = sent.requestId as string;
-      proxy.resolveTransferResult(requestId, { isError: false });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
 
     test("requestToSandbox: targeted request from a different user is rejected", async () => {
@@ -897,6 +893,31 @@ describe("HostTransferProxy — targetClientId", () => {
       await resultPromise;
     });
 
+    test("requestToSandbox: rejects when no client matches the source user", async () => {
+      setup();
+      const a: MockClient = {
+        clientId: "client-A",
+        capabilities: ["host_file"],
+        actorPrincipalId: "user-A",
+      };
+      mockCapableClients = [a];
+      mockClientRegistry.set("client-A", a);
+
+      const result = await proxy.requestToSandbox(
+        {
+          sourcePath: "/host/source.txt",
+          destPath: "/sandbox/dest.txt",
+          conversationId: "conv-same-9-no-match",
+        },
+        undefined,
+        "user-C",
+      );
+
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
+    });
+
     test("requestToSandbox: auto-resolve picks the same-user client when there's exactly one", async () => {
       setup();
       const a: MockClient = {

package/src/__tests__/llm-catalog-parity.test.ts

@@ -6,6 +6,7 @@ import {
   getCatalogProviderForModel,
   isModelInCatalog,
   PROVIDER_CATALOG,
+  supportsForcedToolChoiceWithThinking,
 } from "../providers/model-catalog.js";
 import { PLATFORM_PROVIDER_META } from "../providers/platform-proxy/constants.js";
 import { resolvePricing, resolvePricingForUsage } from "../util/pricing.js";
@@ -551,6 +552,30 @@ describe("LLM catalog parity: daemon vs client", () => {
     expect(getCatalogProviderForModel("unknown/model")).toBeUndefined();
   });
 
+  test("forced tool choice with thinking is scoped to OpenRouter Kimi K2.6", () => {
+    expect(
+      supportsForcedToolChoiceWithThinking("openrouter", "moonshotai/kimi-k2.6"),
+    ).toBe(false);
+    expect(
+      supportsForcedToolChoiceWithThinking(
+        "openrouter",
+        "moonshotai/kimi-k2.6-20260420",
+      ),
+    ).toBe(false);
+    expect(
+      supportsForcedToolChoiceWithThinking(
+        "vercel-ai-gateway",
+        "moonshotai/kimi-k2.6",
+      ),
+    ).toBe(true);
+    expect(
+      supportsForcedToolChoiceWithThinking("openrouter", "unknown/model"),
+    ).toBe(true);
+    expect(
+      supportsForcedToolChoiceWithThinking("unknown-provider", "unknown/model"),
+    ).toBe(true);
+  });
+
   test("Gemini 2.5 Pro catalog context matches provider limits", () => {
     const gemini = PROVIDER_CATALOG.find((entry) => entry.id === "gemini");
     expect(

package/src/__tests__/mcp-auth-routes.test.ts

@@ -24,15 +24,12 @@ mock.module("../mcp/mcp-auth-state.js", () => ({
   getMcpAuthState: mockGetMcpAuthState,
 }));
 
-import { setConfig } from "./helpers/set-config.js";
-
-// Seed the MCP server the routes look up via `loadRawConfig()` into the
-// workspace config for real.
-setConfig("mcp", {
-  servers: {
-    "my-server": {
-      transport: { type: "sse", url: "https://mcp.example.com" },
-    },
+import { setWorkspaceMcp } from "./helpers/set-workspace-mcp.js";
+
+// Seed the MCP server the routes look up via workspace mcp.json.
+setWorkspaceMcp({
+  "my-server": {
+    transport: { type: "sse", url: "https://mcp.example.com" },
   },
 });