@vellumai/assistant 0.12.1 → 0.12.2-dev.202609162214.308bda0

package/src/credential-execution/process-manager.test.ts

@@ -3,33 +3,34 @@ import { createServer, type Server } from "node:net";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
-  afterAll,
   afterEach,
   beforeEach,
   describe,
   expect,
-  mock,
   test,
 } from "bun:test";
 
+import { waitFor } from "../__tests__/helpers/wait-for.js";
 import { createCesProcessManager } from "./process-manager.js";
 
-// ---------------------------------------------------------------------------
-// onTransportClose tests
-// ---------------------------------------------------------------------------
-
-// Mock executable-discovery so start() connects to our test socket.
-const realDiscovery = await import("./executable-discovery.js");
+const untilClosed = (predicate: () => boolean) =>
+  waitFor(predicate, {
+    timeoutMs: 2000,
+    message: "socket close never propagated to the transport",
+  });
 
 let mockSocketPath = "";
 
-mock.module("./executable-discovery.js", () => ({
-  ...realDiscovery,
-  discoverCesWithRetry: async () => ({
-    mode: "sibling" as const,
+function discoverTestSocket() {
+  return Promise.resolve({
+    mode: "managed" as const,
     socketPath: mockSocketPath,
-  }),
-}));
+  });
+}
+
+// ---------------------------------------------------------------------------
+// onTransportClose tests
+// ---------------------------------------------------------------------------
 
 describe("CesProcessManager.onTransportClose", () => {
   let tempDir: string;
@@ -60,12 +61,8 @@ describe("CesProcessManager.onTransportClose", () => {
     rmSync(tempDir, { recursive: true, force: true });
   });
 
-  afterAll(() => {
-    mock.module("./executable-discovery.js", () => realDiscovery);
-  });
-
   test("fires handler when the transport dies (socket closed)", async () => {
-    const pm = createCesProcessManager({});
+    const pm = createCesProcessManager({ discover: discoverTestSocket });
     const transport = await pm.start();
     expect(transport.isAlive()).toBe(true);
 
@@ -79,17 +76,14 @@ describe("CesProcessManager.onTransportClose", () => {
       sock.destroy();
     }
 
-    // Give the close event a tick to propagate.
-    await new Promise((resolve) => setTimeout(resolve, 50));
-
-    expect(closeFired).toBe(true);
+    await untilClosed(() => closeFired);
     expect(transport.isAlive()).toBe(false);
 
     await pm.stop();
   });
 
   test("does not fire handler before the transport dies", async () => {
-    const pm = createCesProcessManager({});
+    const pm = createCesProcessManager({ discover: discoverTestSocket });
     await pm.start();
 
     let closeFired = false;
@@ -105,15 +99,14 @@ describe("CesProcessManager.onTransportClose", () => {
   });
 
   test("fires handler immediately if transport is already dead", async () => {
-    const pm = createCesProcessManager({});
+    const pm = createCesProcessManager({ discover: discoverTestSocket });
     const transport = await pm.start();
 
     // Kill the transport by destroying the server-side socket.
     for (const sock of connections) {
       sock.destroy();
     }
-    await new Promise((resolve) => setTimeout(resolve, 50));
-    expect(transport.isAlive()).toBe(false);
+    await untilClosed(() => !transport.isAlive());
 
     // Register handler AFTER transport is already dead.
     let closeFired = false;
@@ -183,44 +176,46 @@ describe("CesProcessManager transport-death logging", () => {
 
   test("logs WARN when the transport dies unexpectedly (remote close)", async () => {
     const { calls, logger } = makeRecordingLogger();
-    const pm = createCesProcessManager({ logger });
+    const pm = createCesProcessManager({
+      logger,
+      discover: discoverTestSocket,
+    });
     const transport = await pm.start();
 
     // The remote (server) closes the connection: genuinely-unexpected death.
     for (const sock of connections) {
       sock.destroy();
     }
-    await new Promise((resolve) => setTimeout(resolve, 50));
-    expect(transport.isAlive()).toBe(false);
-
-    expect(
+    await untilClosed(() =>
       calls.some(
         (c) => c.level === "warn" && c.msg.includes("died unexpectedly"),
       ),
-    ).toBe(true);
+    );
+    expect(transport.isAlive()).toBe(false);
 
     await pm.stop();
   });
 
   test("does not log WARN on an intentional stop()", async () => {
     const { calls, logger } = makeRecordingLogger();
-    const pm = createCesProcessManager({ logger });
+    const pm = createCesProcessManager({
+      logger,
+      discover: discoverTestSocket,
+    });
     await pm.start();
 
     await pm.stop();
-    // Let the socket close event propagate after destroy().
-    await new Promise((resolve) => setTimeout(resolve, 50));
+    await untilClosed(() =>
+      calls.some(
+        (c) =>
+          c.level === "debug" && c.msg.includes("CES socket transport closed"),
+      ),
+    );
 
     expect(
       calls.some(
         (c) => c.level === "warn" && c.msg.includes("died unexpectedly"),
       ),
     ).toBe(false);
-    expect(
-      calls.some(
-        (c) =>
-          c.level === "debug" && c.msg.includes("CES socket transport closed"),
-      ),
-    ).toBe(true);
   });
 });

package/src/credential-execution/process-manager.ts

@@ -1,17 +1,17 @@
 /**
  * CES process manager.
  *
- * Creates transport connections to the CES process — either a CLI-launched
- * sibling over a Unix socket (bare-metal/local), or a managed sidecar over
- * its bootstrap socket (containerized). The process manager owns only the
- * transport connection lifecycle; the CES process itself is managed by the
- * CLI (sibling) or the pod infrastructure (managed).
+ * Creates a transport connection to the CES process over the shared bootstrap
+ * socket. Local CLI siblings and managed sidecars bind the same path under
+ * `CES_BOOTSTRAP_SOCKET_DIR`. The process manager owns only the transport
+ * connection lifecycle; the CES process itself is managed by the CLI
+ * (sibling) or the pod infrastructure (managed).
  *
- * Managed env contract:
- * - CES_BOOTSTRAP_SOCKET  — Path to the bootstrap Unix socket (shared emptyDir)
- * - /assistant-data-ro     — Assistant data mounted read-only into the CES sidecar
- * - /ces-data              — CES private data directory (separate PVC)
- * - CES_HEALTH_PORT        — Health check port exposed by the CES sidecar
+ * Env contract:
+ * - CES_BOOTSTRAP_SOCKET_DIR: directory containing `ces.sock`
+ * - /assistant-data-ro: assistant data mounted read-only into CES
+ * - /ces-data: CES private data directory (separate PVC)
+ * - CES_HEALTH_PORT: health check port exposed by the CES sidecar
  */
 
 import { createConnection, type Socket } from "node:net";
@@ -24,7 +24,6 @@ import {
   discoverCesWithRetry,
   type DiscoveryResult,
   type ManagedDiscoverySuccess,
-  type SiblingDiscoverySuccess,
 } from "./executable-discovery.js";
 
 const log = getLogger("ces-process-manager");
@@ -62,6 +61,12 @@ export interface CesProcessManagerConfig {
 
   /** Logger override. Defaults to the module logger; injected in tests. */
   logger?: PmLogger;
+
+  /**
+   * Socket discovery. Defaults to `discoverCesWithRetry`. Tests inject a
+   * stub that returns a known socket path.
+   */
+  discover?: typeof discoverCesWithRetry;
 }
 
 // ---------------------------------------------------------------------------
@@ -70,7 +75,7 @@ export interface CesProcessManagerConfig {
 
 export interface CesProcessManager {
   /**
-   * Connect to the CES process (sibling socket or managed sidecar socket).
+   * Connect to the CES bootstrap socket.
    * Returns a CesTransport ready for use with createCesClient().
    *
    * Throws if CES is unavailable.
@@ -107,6 +112,7 @@ export function createCesProcessManager(
   config: CesProcessManagerConfig,
 ): CesProcessManager {
   const pmLog = config.logger ?? log;
+  const discover = config.discover ?? discoverCesWithRetry;
   let managedSocket: Socket | null = null;
   let discoveryResult: DiscoveryResult | null = null;
   let running = false;
@@ -119,16 +125,15 @@ export function createCesProcessManager(
         throw new Error("CES process manager is already running");
       }
 
-      // Poll for the socket with a short backoff. Both the managed bootstrap
-      // socket and the CLI-launched sibling socket are bound asynchronously,
-      // so a reconnecting assistant can briefly race the re-bind.
-      discoveryResult = await discoverCesWithRetry();
+      // Poll for the socket with a short backoff. CES binds
+      // asynchronously, so a reconnecting assistant can briefly race
+      // the re-bind.
+      discoveryResult = await discover();
 
       if (discoveryResult.mode === "unavailable") {
         throw new CesUnavailableError(discoveryResult.reason);
       }
 
-      // managed sidecar or CLI-launched sibling — both connect to a socket.
       const transport = await connectManagedSocket(discoveryResult);
       currentTransport = transport;
       wireTransportClose(transport);
@@ -200,11 +205,11 @@ export function createCesProcessManager(
   }
 
   // -------------------------------------------------------------------------
-  // Socket connection — managed sidecar or CLI-launched local sibling
+  // Socket connection
   // -------------------------------------------------------------------------
 
   async function connectManagedSocket(
-    discovery: ManagedDiscoverySuccess | SiblingDiscoverySuccess,
+    discovery: ManagedDiscoverySuccess,
   ): Promise<SocketTransport> {
     pmLog.info(
       { socketPath: discovery.socketPath, mode: discovery.mode },

package/src/credential-health/credential-health-service.ts

@@ -34,10 +34,7 @@ import {
   type OAuthConnectionRow,
   type OAuthProviderRow,
 } from "../oauth/oauth-store.js";
-import {
-  expectedScopesForStoredToken,
-  scopeDifference,
-} from "../oauth/scope-utils.js";
+import { missingScopesForStoredToken } from "../oauth/scope-utils.js";
 import { credentialKey } from "../security/credential-key.js";
 import {
   getSecureKeyAsync,
@@ -294,26 +291,23 @@ async function checkConnection(
   // token rather than the provider's bot-side `scope` parameter. A provider
   // asking for user scopes as well stores the user token and records that
   // token's grant, so the bot request names scopes that grant can never hold.
-  const grantedScopes = safeJsonParse<string[]>(grantedScopesRaw, []);
-  const expectedScopes = expectedScopesForStoredToken(
+  const missing = missingScopesForStoredToken(
     safeJsonParse<string[]>(defaultScopesRaw, []),
     safeJsonParse<Record<string, string> | undefined>(
       authorizeParamsRaw,
       undefined,
     ),
     scopeSeparator ?? undefined,
+    safeJsonParse<string[]>(grantedScopesRaw, []),
   );
-  if (expectedScopes.length > 0 && grantedScopes.length > 0) {
-    const missing = scopeDifference(expectedScopes, grantedScopes);
-    if (missing.length > 0) {
-      return {
-        ...base,
-        status: "missing_scopes",
-        details: `${provider} is missing required scopes: ${missing.join(", ")}. Features may not work correctly.`,
-        missingScopes: missing,
-        canAutoRecover: false,
-      };
-    }
+  if (missing.length > 0) {
+    return {
+      ...base,
+      status: "missing_scopes",
+      details: `${provider} is missing required scopes: ${missing.join(", ")}. Features may not work correctly.`,
+      missingScopes: missing,
+      canAutoRecover: false,
+    };
   }
 
   // 4. Liveness ping

package/src/daemon/__tests__/conversation-tool-setup-exclude.test.ts

@@ -6,6 +6,7 @@
 
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
 
+import { setOverridesForTesting } from "../../__tests__/feature-flag-test-helpers.js";
 import * as configLoader from "../../config/loader.js";
 import type { AssistantConfig } from "../../config/schema.js";
 import * as disabledState from "../../plugins/disabled-state.js";
@@ -245,3 +246,49 @@ describe("createResolveToolsCallback — config.tools.exclude", () => {
     expect(ctx.allowedToolNames?.has("bash")).toBe(false);
   });
 });
+
+test("managed browser guidance follows each turn without changing native or shared tool definitions", () => {
+  const platform = process.env.IS_PLATFORM;
+  const containerized = process.env.IS_CONTAINERIZED;
+  process.env.IS_PLATFORM = "true";
+  process.env.IS_CONTAINERIZED = "true";
+  setOverridesForTesting({ "assistant-desktop": true });
+  const bash = def("bash");
+  const ctx = makeCtx({
+    conversationId: "conv-browser-guidance",
+    transportInterface: "web",
+    currentTurnClientOs: "web",
+    trustContext: { trustClass: "guardian" } as Conversation["trustContext"],
+    getTurnActorPrincipalId: () => "user-123",
+  });
+  const resolve = createResolveToolsCallback([bash], ctx)!;
+  try {
+    expect(
+      resolve([]).find((tool) => tool.name === "bash")?.description,
+    ).toContain("assistant browser navigate");
+    expect(bash.description).toBe("bash");
+    for (const clientOs of ["macos", "windows", "linux"] as const) {
+      ctx.currentTurnClientOs = clientOs;
+      expect(
+        resolve([]).find((tool) => tool.name === "bash")?.description,
+      ).toBe("bash");
+    }
+    ctx.currentTurnClientOs = "web";
+    setOverridesForTesting({ "assistant-desktop": false });
+    expect(resolve([]).find((tool) => tool.name === "bash")?.description).toBe(
+      "bash",
+    );
+  } finally {
+    setOverridesForTesting({});
+    if (platform === undefined) {
+      delete process.env.IS_PLATFORM;
+    } else {
+      process.env.IS_PLATFORM = platform;
+    }
+    if (containerized === undefined) {
+      delete process.env.IS_CONTAINERIZED;
+    } else {
+      process.env.IS_CONTAINERIZED = containerized;
+    }
+  }
+});