@vellumai/assistant 0.12.2-staging.1 → 0.12.2-staging.3

package/src/__tests__/conversation-error.test.ts

@@ -1490,6 +1490,7 @@ describe("classifyConversationError", () => {
       "subagent_aborted",
       "signal_cancel",
       "voice_session_aborted",
+      "voice_progress_narration_timeout",
     ];
 
     for (const kind of taggedKinds) {
@@ -1727,7 +1728,9 @@ describe("ConnectionResolutionError classification", () => {
     expect(result.userMessage).toContain("qwen/qwen3-8b");
     expect(result.userMessage).toContain("Vellum GPU route");
     expect(result.userMessage).toContain('profile "steer"');
-    expect(result.userMessage).toContain("was not sent through another provider");
+    expect(result.userMessage).toContain(
+      "was not sent through another provider",
+    );
   });
 
   it("classifies missing_credential naming the connection and fix", () => {

package/src/__tests__/conversation-runtime-assembly.test.ts

@@ -119,6 +119,7 @@ import {
   applyRuntimeInjections,
   assembleSlackActiveThreadFocusBlock,
   assembleSlackChronologicalMessages,
+  buildChannelCapabilityBlock,
   buildSubagentStatusBlock,
   getSlackCompactionWatermarkForPrefix,
   getSlackWatermarkAdvanceForRowPrefix,
@@ -586,6 +587,35 @@ describe("injectChannelCapabilityContext", () => {
     expect(text).not.toContain("Do NOT use ui_show, ui_update, or app_create");
   });
 
+  test("guides non-interactive turns to persist UI for a later capable client", () => {
+    const slack: ChannelCapabilities = {
+      channel: "slack",
+      dashboardCapable: false,
+      supportsDynamicUi: false,
+      supportsVoiceInput: false,
+    };
+    const phone: ChannelCapabilities = {
+      channel: "phone",
+      dashboardCapable: false,
+      supportsDynamicUi: false,
+      supportsVoiceInput: false,
+    };
+
+    for (const caps of [slack, phone]) {
+      const text = buildChannelCapabilityBlock(caps, undefined, true)!;
+      expect(text).toContain(
+        "ui_show, ui_update, and ui_dismiss persist conversation content",
+      );
+      expect(text).not.toContain("Only use ui_show/ui_update");
+      expect(text).not.toContain(
+        "Do NOT use ui_show, ui_update, or app_create",
+      );
+      expect(text).not.toContain(
+        "Present information as well-formatted text instead of dynamic UI.",
+      );
+    }
+  });
+
   test("keeps blanket ui_show/ui_update prohibition for other non-dynamic channels", () => {
     const caps: ChannelCapabilities = {
       channel: "phone",
@@ -870,12 +900,12 @@ describe("trust-gating via channel capabilities", () => {
 
     const result = injectChannelCapabilityContext(message, caps);
 
-    // macOS clients now get osascript guidance injected
+    // macOS clients get app-scripting guidance injected
     expect(result).not.toBe(message);
     const injected = (result.content[0] as { type: "text"; text: string }).text;
     expect(injected).toContain("client_os: macos");
-    expect(injected).toContain("osascript");
-    expect(injected).toContain("host_bash");
+    expect(injected).toContain("drive apps with the computer-use skill");
+    expect(injected).toContain("`host_bash` is for shell commands");
     // No channel constraints — full desktop capabilities
     expect(injected).not.toContain("CHANNEL CONSTRAINTS");
   });

package/src/__tests__/conversation-surfaces-point-at-budget.test.ts

@@ -24,6 +24,7 @@ function proxyDouble() {
       recordAction,
       request,
       reset: () => {},
+      endTask: () => {},
       stepCount: 0,
     },
   };

package/src/__tests__/conversation-surfaces-point-at-capability.test.ts

@@ -30,6 +30,7 @@ function proxyDouble() {
       recordAction: () => {},
       request,
       reset: () => {},
+      endTask: () => {},
       stepCount: 0,
     },
   };

package/src/__tests__/credential-routes.test.ts

@@ -532,6 +532,28 @@ describe("credentials routes", () => {
       );
     });
 
+    test("stores a pasted Claude token without touching leftover refresh material", async () => {
+      secureStore.set("acp:claude_oauth_refresh_token", "stale-refresh");
+      secureStore.set("acp:claude_oauth_expires_at", "111");
+
+      await setRoute!.handler({
+        body: {
+          service: "acp",
+          field: "claude_oauth_token",
+          value: "sk-ant-oat01-pasted-token",
+        },
+      });
+
+      expect(secureStore.get("acp:claude_oauth_token")).toBe(
+        "sk-ant-oat01-pasted-token",
+      );
+      expect(secureStore.get("acp:claude_oauth_refresh_token")).toBe(
+        "stale-refresh",
+      );
+      expect(secureStore.get("acp:claude_oauth_expires_at")).toBe("111");
+    });
+
+
     test("a successful set scrubs the normalized value from transcripts exactly once", async () => {
       /**
        * The pasted plaintext may already sit in recent transcripts, so a
@@ -1301,5 +1323,21 @@ describe("credentials routes", () => {
       // THEN it rejects with a BadRequestError
       await expect(call).rejects.toBeInstanceOf(BadRequestError);
     });
+
+    test("deletes only the requested Claude access-token field", async () => {
+      secureStore.set("acp:claude_oauth_token", "sk-ant-oat01-connected");
+      secureStore.set("acp:claude_oauth_refresh_token", "refresh-leftover");
+      secureStore.set("acp:claude_oauth_expires_at", "111");
+
+      await deleteRoute!.handler({
+        body: { service: "acp", field: "claude_oauth_token" },
+      });
+
+      expect(secureStore.has("acp:claude_oauth_token")).toBe(false);
+      expect(secureStore.get("acp:claude_oauth_refresh_token")).toBe(
+        "refresh-leftover",
+      );
+      expect(secureStore.get("acp:claude_oauth_expires_at")).toBe("111");
+    });
   });
 });

package/src/__tests__/credential-security-invariants.test.ts

@@ -190,7 +190,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "oauth/credential-token-resolver.ts", // centralized access-token key resolution for OAuth and manual-token providers
       "oauth/connection-resolver.ts", // resolve OAuthConnection from oauth-store (access_token lookup)
       "runtime/routes/secret-routes.ts", // HTTP secret management routes (set/delete secrets)
-      "acp/acp-claude-oauth.ts", // Connect Claude OAuth token vault-store helper (stores sk-ant-oat token via setSecureKeyAsync)
+      "acp/acp-claude-oauth.ts", // Connect Claude OAuth token vault-store helper (stores access token plus broker-owned refresh/expiry companions via setSecureKeyAsync)
       "runtime/routes/acp-claude-auth-routes.ts", // Connect Claude Code daemon OAuth flow (stores OAuth token in vault)
       "runtime/routes/migration-routes.ts", // migration import credential restore
       "daemon/conversation-messaging.ts", // credential storage during session messaging

package/src/__tests__/cu-unified-flow.test.ts

@@ -485,8 +485,12 @@ describe("surfaceProxyResolver — CU tool routing", () => {
       // Proxy state is clean after done
       expect(proxy.stepCount).toBe(0);
       expect(proxy.actionHistory).toHaveLength(0);
-      // Only 2 messages sent to client (screenshot + click; done is terminal)
-      expect(sentMessages).toHaveLength(2);
+      // screenshot + click, then done tells the client the task ended so the
+      // helper returns the pointer; done itself never reaches the client
+      expect(sentMessages).toHaveLength(3);
+      expect((sentMessages[2] as Record<string, unknown>).type).toBe(
+        "host_cu_cancel",
+      );
     });
   });
 

package/src/__tests__/external-plugin-loader.test.ts

@@ -39,6 +39,20 @@ function writePackageJson(dir: string, pkg: Record<string, unknown>): void {
   writeFileSync(join(dir, "package.json"), JSON.stringify(pkg, null, 2));
 }
 
+function writePluginJson(dir: string, manifest: Record<string, unknown>): void {
+  writeFileSync(
+    join(dir, "plugin.json"),
+    JSON.stringify(
+      {
+        $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+        ...manifest,
+      },
+      null,
+      2,
+    ),
+  );
+}
+
 function writeSurfaceFile(dir: string, relPath: string, body: string): void {
   const parts = relPath.split("/");
   parts.pop();
@@ -104,6 +118,31 @@ describe("loadExternalPlugin — manifest", () => {
     expect(registered).toBeDefined();
     expect(registered?.manifest.version).toBe("0.0.0");
   });
+
+  test("loads a standard plugin.json when package.json is absent", async () => {
+    const dir = freshPluginDir("standard-only");
+    writePluginJson(dir, { name: "standard-only", version: "2.1.0" });
+
+    await loadExternalPlugin(dir);
+
+    const registered = getRegisteredPlugins().find(
+      (plugin) => plugin.manifest.name === "standard-only",
+    );
+    expect(registered?.manifest.version).toBe("2.1.0");
+  });
+
+  test("keeps package.json authoritative when plugin.json is also present", async () => {
+    const dir = freshPluginDir("mixed-manifests");
+    writePackageJson(dir, { name: "legacy-name", version: "1.2.3" });
+    writeFileSync(join(dir, "plugin.json"), "{ foreign and malformed }");
+
+    await loadExternalPlugin(dir);
+
+    const registered = getRegisteredPlugins().find(
+      (plugin) => plugin.manifest.name === "mixed-manifests",
+    );
+    expect(registered?.manifest.version).toBe("1.2.3");
+  });
 });
 
 describe("credentialKeyPatterns manifest field", () => {
@@ -277,6 +316,19 @@ describe("loadExternalPlugin — plugin-api peerDependency", () => {
   test("malformed package.json is logged and skipped (registry untouched)", async () => {
     const dir = freshPluginDir("malformed-pkg");
     writeFileSync(join(dir, "package.json"), "{ this is not json");
+    writePluginJson(dir, { name: "valid-standard-fallback" });
+
+    await loadExternalPlugin(dir);
+
+    expect(registeredNames()).toHaveLength(0);
+  });
+
+  test("malformed selected plugin.json is logged and skipped", async () => {
+    const dir = freshPluginDir("malformed-standard");
+    writeFileSync(
+      join(dir, "plugin.json"),
+      JSON.stringify({ name: "missing-schema" }),
+    );
 
     await loadExternalPlugin(dir);
 

package/src/__tests__/headless-browser-mode.test.ts

@@ -41,6 +41,16 @@ function makeFakeCdp(
     dispose() {
       _cdpDisposed = true;
     },
+    setCdpSessionId() {},
+    async listTabs() {
+      return [];
+    },
+    async selectTab(tabId: number) {
+      return { tabId };
+    },
+    async closeTab(tabId: number) {
+      return { tabId, closed: true };
+    },
   };
 }
 
@@ -142,6 +152,8 @@ mock.module("../tools/network/url-safety.js", () => ({
 
 import {
   executeBrowserClick,
+  executeBrowserClose,
+  executeBrowserDetach,
   executeBrowserNavigate,
   executeBrowserScreenshot,
   executeBrowserSnapshot,
@@ -687,6 +699,42 @@ describe("browser_mode wiring through tool execution", () => {
 
   // ── Per-conversation sticky backend kind ─────────────────────────
 
+  for (const release of [executeBrowserDetach, executeBrowserClose]) {
+    test.each(["local", "extension", "cdp-inspect"])(
+      `${release.name} on desktop preserves the normal %s session's backend`,
+      async (mode) => {
+        const first = await executeBrowserSnapshot({ browser_mode: mode }, ctx);
+        expect(first.isError).toBe(false);
+
+        factoryModeCalls.length = 0;
+        const desktop = await release(
+          {},
+          {
+            ...ctx,
+            cdpClient: makeFakeCdp(
+              "cdp-inspect",
+              `desktop-browser:${ctx.conversationId}`,
+            ),
+          },
+        );
+        expect(desktop.isError).toBe(false);
+        expect(factoryModeCalls).toEqual([]);
+
+        const resumed = await executeBrowserSnapshot({}, ctx);
+        expect(resumed.isError).toBe(false);
+        expect(factoryModeCalls).toEqual([mode]);
+      },
+    );
+
+    test(`${release.name} on the normal browser still resets automatic selection`, async () => {
+      await executeBrowserSnapshot({ browser_mode: "extension" }, ctx);
+      expect((await release({}, ctx)).isError).toBe(false);
+      factoryModeCalls.length = 0;
+      expect((await executeBrowserSnapshot({}, ctx)).isError).toBe(false);
+      expect(factoryModeCalls).toEqual(["auto"]);
+    });
+  }
+
   test("auto-mode call after an explicit pin sticks to the pinned kind", async () => {
     const first = await executeBrowserNavigate(
       { url: "https://example.com", browser_mode: "local" },