@vellumai/assistant 0.3.27 → 0.4.0

package/src/__tests__/credential-security-invariants.test.ts

@@ -61,6 +61,7 @@ mock.module('../tools/registry.js', () => ({
 // Imports under test
 // ---------------------------------------------------------------------------
 
+import { DEFAULT_CONFIG } from '../config/defaults.js';
 import { redactSensitiveFields } from '../security/redaction.js';
 import { setSecureKey } from '../security/secure-keys.js';
 import { CredentialBroker } from '../tools/credentials/broker.js';
@@ -125,7 +126,18 @@ describe('Invariant 1: secrets never enter LLM context', () => {
   test('user message containing secret is blocked from entering history', () => {
     // Mock config to enable block mode
     mock.module('../config/loader.js', () => ({
+      applyNestedDefaults: (config: unknown) => config,
       getConfig: () => ({
+        ui: {},
+        secretDetection: {
+          enabled: true,
+          action: 'block',
+          blockIngress: true,
+        },
+      }),
+      invalidateConfigCache: () => {},
+      loadConfig: () => ({
+        ui: {},
         secretDetection: {
           enabled: true,
           action: 'block',
@@ -204,6 +216,10 @@ describe('Invariant 2: no generic plaintext secret read API', () => {
       'messaging/providers/telegram-bot/adapter.ts', // Telegram bot token lookup for connectivity check
       'messaging/providers/sms/adapter.ts', // Twilio credential lookup for SMS connectivity check
       'runtime/channel-readiness-service.ts', // channel readiness probes for SMS/Telegram connectivity
+      'messaging/providers/whatsapp/adapter.ts', // WhatsApp credential lookup for connectivity check
+      'schedule/integration-status.ts',          // integration status checks for scheduled reports
+      'daemon/handlers/oauth-connect.ts',        // OAuth connect handler for integration setup
+      'daemon/handlers/config-slack-channel.ts', // Slack channel config credential management
     ]);
 
     const thisDir = dirname(fileURLToPath(import.meta.url));
@@ -436,20 +452,14 @@ describe('One-time send override', () => {
   });
 
   test('allowOneTimeSend defaults to false in config', () => {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { DEFAULT_CONFIG } = require('../config/defaults.js');
     expect(DEFAULT_CONFIG.secretDetection.allowOneTimeSend).toBe(false);
   });
 
   test('default secretDetection.action is redact', () => {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { DEFAULT_CONFIG } = require('../config/defaults.js');
     expect(DEFAULT_CONFIG.secretDetection.action).toBe('redact');
   });
 
   test('default secretDetection.blockIngress is true', () => {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { DEFAULT_CONFIG } = require('../config/defaults.js');
     expect(DEFAULT_CONFIG.secretDetection.blockIngress).toBe(true);
   });
 });

package/src/__tests__/credential-vault-unit.test.ts

@@ -470,7 +470,7 @@ describe('credential_store tool — oauth2_connect error paths', () => {
       client_id: 'test-client-id',
     }, { ..._ctx, isInteractive: false });
     expect(result.isError).toBe(true);
-    expect(result.content).toContain('interactive client session');
+    expect(result.content).toContain('non-interactive session');
   });
 
   test('resolves gmail alias to integration:gmail', async () => {
@@ -672,7 +672,7 @@ describe('credential_store tool — tool definition', () => {
     expect(schema.required).toContain('action');
     const props = schema.properties as Record<string, Record<string, unknown>>;
     expect(props.action.enum).toEqual(
-      ['store', 'list', 'delete', 'prompt', 'oauth2_connect'],
+      ['store', 'list', 'delete', 'prompt', 'oauth2_connect', 'describe'],
     );
   });
 

package/src/__tests__/credential-vault.test.ts

@@ -406,18 +406,19 @@ describe('credential_store tool', () => {
       expect(entries[0].service).toBe('svc-b');
     });
 
-    test('returns error when secure storage is corrupt/unreadable', async () => {
+    test('recovers from corrupt secure storage by resetting and returning empty list', async () => {
       // Store a credential so metadata exists
       await credentialStoreTool.execute({
         action: 'store', service: 'svc-x', field: 'key', value: 'val-x',
       }, _ctx);
 
-      // Corrupt the encrypted store file so listKeys() throws
+      // Corrupt the encrypted store file — the store auto-recovers by
+      // backing up the corrupt file and creating a fresh store
       writeFileSync(STORE_PATH, 'not-valid-json!!!', 'utf-8');
 
       const result = await credentialStoreTool.execute({ action: 'list' }, _ctx);
-      expect(result.isError).toBe(true);
-      expect(result.content).toContain('failed to read secure storage');
+      // Store auto-recovers: list succeeds but the corrupted credentials are lost
+      expect(result.isError).toBe(false);
     });
   });
 

package/src/__tests__/daemon-lifecycle.test.ts

@@ -94,6 +94,15 @@ const conversation = {
 };
 
 mock.module('../memory/conversation-store.js', () => ({
+  setConversationOriginChannelIfUnset: () => {},
+  updateConversationContextWindow: () => {},
+  deleteMessageById: () => {},
+  updateConversationTitle: () => {},
+  updateConversationUsage: () => {},
+  addMessage: () => ({ id: 'mock-msg-id' }),
+  provenanceFromGuardianContext: () => ({ source: 'user', guardianContext: undefined }),
+  getConversationOriginInterface: () => null,
+  getConversationOriginChannel: () => null,
   getLatestConversation: () => conversation,
   createConversation: () => conversation,
   getConversation: (id: string) => (id === conversation.id ? conversation : null),

package/src/__tests__/daemon-server-session-init.test.ts

@@ -203,6 +203,8 @@ mock.module('../providers/ratelimit.js', () => ({
 
 mock.module('../config/loader.js', () => ({
   getConfig: () => ({
+    ui: {},
+    
     provider: 'mock-provider',
     providerOrder: ['mock-provider'],
     maxTokens: 4096,
@@ -243,7 +245,31 @@ mock.module('../memory/external-conversation-store.js', () => ({
   getBindingsForConversations: () => new Map(),
 }));
 
+mock.module('../memory/conversation-attention-store.js', () => ({
+  getAttentionStateByConversationIds: () => new Map(),
+  recordAttentionSignal: () => {},
+  recordConversationSeenSignal: () => {},
+}));
+
+mock.module('../memory/canonical-guardian-store.js', () => ({
+  generateCanonicalRequestCode: () => 'mock-code-0000',
+  createCanonicalGuardianRequest: () => ({ requestCode: 'mock-code-0000', status: 'pending' }),
+  submitCanonicalRequest: () => ({ requestCode: 'mock-code-0000', status: 'pending' }),
+  getCanonicalRequest: () => null,
+  resolveCanonicalRequest: () => false,
+  listPendingCanonicalRequests: () => [],
+}));
+
 mock.module('../memory/conversation-store.js', () => ({
+  setConversationOriginChannelIfUnset: () => {},
+  updateConversationContextWindow: () => {},
+  deleteMessageById: () => {},
+  updateConversationTitle: () => {},
+  updateConversationUsage: () => {},
+  addMessage: () => ({ id: 'mock-msg-id' }),
+  provenanceFromGuardianContext: () => ({ source: 'user', guardianContext: undefined }),
+  getConversationOriginInterface: () => null,
+  getConversationOriginChannel: () => null,
   getLatestConversation: () => conversation,
   createConversation: (titleOrOpts?: string | { title?: string; threadType?: string }) => {
     lastCreateConversationArgs = titleOrOpts;
@@ -266,6 +292,7 @@ mock.module('../memory/conversation-store.js', () => ({
   getMessages: () => [],
   listConversations: () => [conversation],
   countConversations: () => 1,
+  getDisplayMetaForConversations: () => new Map(),
 }));
 
 mock.module('../daemon/session.js', () => ({

package/src/__tests__/elevenlabs-config.test.ts

@@ -27,6 +27,8 @@ let mockVoiceConfig = {
 
 mock.module('../config/loader.js', () => ({
   getConfig: () => ({
+    ui: {},
+    
     calls: { voice: mockVoiceConfig },
   }),
 }));

package/src/__tests__/emit-signal-routing-intent.test.ts

@@ -7,6 +7,7 @@ const runDeterministicChecksMock = mock();
 const createEventMock = mock();
 const updateEventDedupeKeyMock = mock();
 const dispatchDecisionMock = mock();
+const activeBindingChannels = new Set<string>(['telegram']);
 
 mock.module('../util/logger.js', () => ({
   getLogger: () =>
@@ -21,7 +22,7 @@ mock.module('../channels/config.js', () => ({
 
 mock.module('../memory/channel-guardian-store.js', () => ({
   getActiveBinding: (_assistantId: string, channel: string) =>
-    channel === 'telegram'
+    activeBindingChannels.has(channel)
       ? {
         guardianDeliveryChatId: 'guardian-chat-123',
         guardianExternalUserId: 'guardian-user-123',
@@ -83,6 +84,8 @@ describe('emitNotificationSignal routing intent re-persistence', () => {
     createEventMock.mockReset();
     updateEventDedupeKeyMock.mockReset();
     dispatchDecisionMock.mockReset();
+    activeBindingChannels.clear();
+    activeBindingChannels.add('telegram');
 
     createEventMock.mockReturnValue({ id: 'evt-1' });
     runDeterministicChecksMock.mockResolvedValue({ passed: true });
@@ -176,4 +179,43 @@ describe('emitNotificationSignal routing intent re-persistence', () => {
 
     expect(updateDecisionMock).not.toHaveBeenCalled();
   });
+
+  test('excludes unverified binding channels from connected channel candidates', async () => {
+    activeBindingChannels.clear();
+
+    const decision = {
+      shouldNotify: true,
+      selectedChannels: ['vellum'],
+      reasoningSummary: 'Local only',
+      renderedCopy: {
+        vellum: { title: 'Reminder', body: 'Check this' },
+      },
+      dedupeKey: 'dedupe-rem-3',
+      confidence: 0.8,
+      fallbackUsed: false,
+      persistedDecisionId: 'dec-3',
+    };
+
+    evaluateSignalMock.mockResolvedValue(decision);
+    enforceRoutingIntentMock.mockImplementation((inputDecision: unknown) => inputDecision);
+
+    await emitNotificationSignal({
+      sourceEventName: 'reminder.fired',
+      sourceChannel: 'scheduler',
+      sourceSessionId: 'rem-3',
+      attentionHints: {
+        requiresAction: false,
+        urgency: 'medium',
+        isAsyncBackground: false,
+        visibleInSourceNow: false,
+      },
+      contextPayload: { reminderId: 'rem-3' },
+      routingIntent: 'single_channel',
+    });
+
+    expect(evaluateSignalMock).toHaveBeenCalled();
+    const callArgs = evaluateSignalMock.mock.calls[0];
+    expect(callArgs).toBeDefined();
+    expect(callArgs?.[1]).toEqual(['vellum']);
+  });
 });

package/src/__tests__/encrypted-store.test.ts

@@ -253,24 +253,29 @@ describe('encrypted-store', () => {
       expect(getKey('test')).toBe('value');
     });
 
-    test('setKey refuses to overwrite a corrupt store file', () => {
+    test('setKey recovers from a corrupt store file by backing up and creating fresh store', () => {
       // Write a valid store first
       setKey('existing', 'old-secret');
       // Corrupt the store
       writeFileSync(STORE_PATH, 'corrupted data');
-      // setKey should fail rather than overwrite with new salt
+      // setKey should recover by backing up corrupt file and creating fresh store
       const result = setKey('new-key', 'new-value');
-      expect(result).toBe(false);
+      expect(result).toBe(true);
+      // Old key is lost but new key works
+      expect(getKey('new-key')).toBe('new-value');
+      expect(getKey('existing')).toBeUndefined();
     });
 
-    test('setKey refuses to overwrite a store with invalid version', () => {
+    test('setKey recovers from a store with invalid version', () => {
       writeFileSync(STORE_PATH, JSON.stringify({
         version: 99,
         salt: 'abc',
         entries: {},
       }));
+      // setKey should recover by backing up invalid store and creating fresh store
       const result = setKey('test', 'value');
-      expect(result).toBe(false);
+      expect(result).toBe(true);
+      expect(getKey('test')).toBe('value');
     });
 
     test('writeStore enforces 0600 permissions on existing files', () => {

package/src/__tests__/followup-tools.test.ts

@@ -27,7 +27,9 @@ mock.module('../util/logger.js', () => ({
 }));
 
 mock.module('../config/loader.js', () => ({
-  getConfig: () => ({ memory: {} }),
+  getConfig: () => ({
+    ui: {},
+     memory: {} }),
 }));
 
 import type { Database } from 'bun:sqlite';

package/src/__tests__/gateway-only-enforcement.test.ts

@@ -243,9 +243,9 @@ describe('gateway-only ingress enforcement', () => {
         body: makeFormBody({ CallSid: 'CA123', AccountSid: 'AC_test' }),
       });
       expect(res.status).toBe(410);
-      const body = await res.json() as { error: string; code: string };
-      expect(body.code).toBe('GATEWAY_ONLY');
-      expect(body.error).toContain('Direct webhook access disabled');
+      const body = await res.json() as { error: { code: string; message: string } };
+      expect(body.error.code).toBe('GONE');
+      expect(body.error.message).toContain('Direct webhook access disabled');
     });
 
     test('POST /webhooks/twilio/status returns 410', async () => {
@@ -255,8 +255,8 @@ describe('gateway-only ingress enforcement', () => {
         body: makeFormBody({ CallSid: 'CA123', CallStatus: 'completed' }),
       });
       expect(res.status).toBe(410);
-      const body = await res.json() as { error: string; code: string };
-      expect(body.code).toBe('GATEWAY_ONLY');
+      const body = await res.json() as { error: { code: string; message: string } };
+      expect(body.error.code).toBe('GONE');
     });
 
     test('POST /webhooks/twilio/connect-action returns 410', async () => {
@@ -266,8 +266,8 @@ describe('gateway-only ingress enforcement', () => {
         body: makeFormBody({ CallSid: 'CA123' }),
       });
       expect(res.status).toBe(410);
-      const body = await res.json() as { error: string; code: string };
-      expect(body.code).toBe('GATEWAY_ONLY');
+      const body = await res.json() as { error: { code: string; message: string } };
+      expect(body.error.code).toBe('GONE');
     });
 
     test('POST /v1/calls/twilio/voice-webhook returns 410', async () => {
@@ -277,8 +277,8 @@ describe('gateway-only ingress enforcement', () => {
         body: makeFormBody({ CallSid: 'CA123' }),
       });
       expect(res.status).toBe(410);
-      const body = await res.json() as { error: string; code: string };
-      expect(body.code).toBe('GATEWAY_ONLY');
+      const body = await res.json() as { error: { code: string; message: string } };
+      expect(body.error.code).toBe('GONE');
     });
 
     test('POST /v1/calls/twilio/status returns 410', async () => {
@@ -288,8 +288,8 @@ describe('gateway-only ingress enforcement', () => {
         body: makeFormBody({ CallSid: 'CA123', CallStatus: 'completed' }),
       });
       expect(res.status).toBe(410);
-      const body = await res.json() as { error: string; code: string };
-      expect(body.code).toBe('GATEWAY_ONLY');
+      const body = await res.json() as { error: { code: string; message: string } };
+      expect(body.error.code).toBe('GONE');
     });
   });
 
@@ -304,9 +304,9 @@ describe('gateway-only ingress enforcement', () => {
         body: makeFormBody({ Body: 'hello', From: '+15551234567', To: '+15559876543', MessageSid: 'SM123' }),
       });
       expect(res.status).toBe(410);
-      const body = await res.json() as { error: string; code: string };
-      expect(body.code).toBe('GATEWAY_ONLY');
-      expect(body.error).toContain('Direct webhook access disabled');
+      const body = await res.json() as { error: { code: string; message: string } };
+      expect(body.error.code).toBe('GONE');
+      expect(body.error.message).toContain('Direct webhook access disabled');
     });
 
     test('POST /v1/calls/twilio/sms returns 410 (legacy path also blocked)', async () => {
@@ -316,8 +316,8 @@ describe('gateway-only ingress enforcement', () => {
         body: makeFormBody({ Body: 'hello', From: '+15551234567', MessageSid: 'SM456' }),
       });
       expect(res.status).toBe(410);
-      const body = await res.json() as { error: string; code: string };
-      expect(body.code).toBe('GATEWAY_ONLY');
+      const body = await res.json() as { error: { code: string; message: string } };
+      expect(body.error.code).toBe('GONE');
     });
 
     test('POST /webhooks/twilio/sms with valid auth still returns 410 (auth does not bypass gateway-only)', async () => {
@@ -331,8 +331,8 @@ describe('gateway-only ingress enforcement', () => {
       });
       // The gateway-only guard runs before auth for Twilio webhook paths
       expect(res.status).toBe(410);
-      const body = await res.json() as { error: string; code: string };
-      expect(body.code).toBe('GATEWAY_ONLY');
+      const body = await res.json() as { error: { code: string; message: string } };
+      expect(body.error.code).toBe('GONE');
     });
   });
 
@@ -407,9 +407,9 @@ describe('gateway-only ingress enforcement', () => {
         },
       });
       expect(res.status).toBe(403);
-      const body = await res.json() as { error: string; code: string };
-      expect(body.code).toBe('GATEWAY_ONLY');
-      expect(body.error).toContain('Direct relay access disabled');
+      const body = await res.json() as { error: { code: string; message: string } };
+      expect(body.error.code).toBe('FORBIDDEN');
+      expect(body.error.message).toContain('Direct relay access disabled');
     });
 
     test('allows request with no origin header (private network peer)', async () => {

package/src/__tests__/gmail-integration.test.ts

@@ -41,7 +41,6 @@ describe('Messaging tool contract', () => {
     'messaging_read',
     'messaging_search',
     'messaging_send',
-    'send_notification',
     'messaging_reply',
     'messaging_mark_read',
     'messaging_analyze_activity',