@vellumai/assistant 0.3.4 → 0.3.6

package/src/__tests__/messaging-send-tool.test.ts

@@ -0,0 +1,65 @@
+import { beforeEach, describe, expect, mock, test } from 'bun:test';
+import type { MessagingProvider } from '../messaging/provider.js';
+import type { SendOptions } from '../messaging/provider-types.js';
+
+const sendMessageMock = mock(async (..._args: unknown[]) => ({
+  id: 'msg-1',
+  timestamp: 123,
+  conversationId: 'conv-1',
+}));
+
+const provider: MessagingProvider = {
+  id: 'sms',
+  displayName: 'SMS',
+  credentialService: 'twilio',
+  capabilities: new Set(['send']),
+  testConnection: async () => ({ connected: true, user: 'x', platform: 'sms' }),
+  listConversations: async () => [],
+  getHistory: async () => [],
+  search: async () => ({ total: 0, messages: [], hasMore: false }),
+  sendMessage: (token: string, conversationId: string, text: string, options?: SendOptions) =>
+    sendMessageMock(token, conversationId, text, options),
+};
+
+mock.module('../config/bundled-skills/messaging/tools/shared.js', () => ({
+  resolveProvider: () => provider,
+  withProviderToken: async (_provider: MessagingProvider, fn: (token: string) => Promise<unknown>) => fn('provider-token'),
+  ok: (content: string) => ({ content, isError: false }),
+  err: (content: string) => ({ content, isError: true }),
+}));
+
+import { run } from '../config/bundled-skills/messaging/tools/messaging-send.js';
+
+describe('messaging-send tool', () => {
+  beforeEach(() => {
+    sendMessageMock.mockClear();
+  });
+
+  test('passes assistantId from tool context to provider send options', async () => {
+    const result = await run(
+      {
+        platform: 'sms',
+        conversation_id: '+15550004444',
+        text: 'test message',
+      },
+      {
+        workingDir: '/tmp',
+        sessionId: 'sess-1',
+        conversationId: 'conv-1',
+        assistantId: 'ast-alpha',
+      },
+    );
+
+    expect(result.isError).toBe(false);
+    expect(sendMessageMock).toHaveBeenCalledWith(
+      'provider-token',
+      '+15550004444',
+      'test message',
+      {
+        subject: undefined,
+        inReplyTo: undefined,
+        assistantId: 'ast-alpha',
+      },
+    );
+  });
+});

package/src/__tests__/model-intents.test.ts

@@ -0,0 +1,96 @@
+import { describe, expect, test } from 'bun:test';
+import type { Message, Provider, ProviderResponse, SendMessageOptions } from '../providers/types.js';
+import { RetryProvider } from '../providers/retry.js';
+import { getProviderDefaultModel, isModelIntent, resolveModelIntent } from '../providers/model-intents.js';
+
+const DUMMY_MESSAGES: Message[] = [
+  { role: 'user', content: [{ type: 'text', text: 'hello' }] },
+];
+
+function makeResponse(model: string): ProviderResponse {
+  return {
+    content: [{ type: 'text', text: 'ok' }],
+    model,
+    usage: {
+      inputTokens: 1,
+      outputTokens: 1,
+    },
+    stopReason: 'end_turn',
+  };
+}
+
+function makeProvider(
+  name: string,
+  onCall: (options: SendMessageOptions | undefined) => void,
+): Provider {
+  return {
+    name,
+    async sendMessage(_messages, _tools, _systemPrompt, options) {
+      onCall(options);
+      const config = options?.config as Record<string, unknown> | undefined;
+      return makeResponse((config?.model as string | undefined) ?? 'default-model');
+    },
+  };
+}
+
+describe('model intents', () => {
+  test('validates model intent strings', () => {
+    expect(isModelIntent('latency-optimized')).toBe(true);
+    expect(isModelIntent('quality-optimized')).toBe(true);
+    expect(isModelIntent('vision-optimized')).toBe(true);
+    expect(isModelIntent('fastest-model')).toBe(false);
+    expect(isModelIntent(undefined)).toBe(false);
+  });
+
+  test('resolves intent to provider-specific model', () => {
+    expect(resolveModelIntent('anthropic', 'latency-optimized')).toBe('claude-haiku-4-5-20251001');
+    expect(resolveModelIntent('anthropic', 'quality-optimized')).toBe('claude-opus-4-6');
+    expect(resolveModelIntent('anthropic', 'vision-optimized')).toBe('claude-sonnet-4-6');
+    expect(resolveModelIntent('openai', 'latency-optimized')).toBe('gpt-4o-mini');
+  });
+
+  test('falls back to provider default for unknown providers', () => {
+    expect(getProviderDefaultModel('unknown-provider')).toBe('claude-opus-4-6');
+    expect(resolveModelIntent('unknown-provider', 'quality-optimized')).toBe('claude-opus-4-6');
+  });
+});
+
+describe('RetryProvider model intent normalization', () => {
+  test('translates modelIntent into concrete model and strips modelIntent key', async () => {
+    let seen: SendMessageOptions | undefined;
+    const wrapped = new RetryProvider(makeProvider('anthropic', (options) => {
+      seen = options;
+    }));
+
+    await wrapped.sendMessage(DUMMY_MESSAGES, undefined, undefined, {
+      config: {
+        modelIntent: 'quality-optimized',
+        max_tokens: 123,
+      },
+    });
+
+    const config = seen?.config as Record<string, unknown>;
+    expect(config.model).toBe('claude-opus-4-6');
+    expect(config.modelIntent).toBeUndefined();
+    expect(config.max_tokens).toBe(123);
+  });
+
+  test('explicit model override wins over modelIntent', async () => {
+    let seen: SendMessageOptions | undefined;
+    const wrapped = new RetryProvider(makeProvider('openai', (options) => {
+      seen = options;
+    }));
+
+    await wrapped.sendMessage(DUMMY_MESSAGES, undefined, undefined, {
+      config: {
+        model: 'custom-model-v1',
+        modelIntent: 'latency-optimized',
+      },
+    });
+
+    const config = seen?.config as Record<string, unknown>;
+    expect(config.model).toBe('custom-model-v1');
+    expect(config.modelIntent).toBeUndefined();
+  });
+});
+

package/src/__tests__/no-direct-anthropic-sdk-imports.test.ts

@@ -0,0 +1,42 @@
+import { execSync } from 'node:child_process';
+import { describe, expect, test } from 'bun:test';
+
+/**
+ * Guard test: production files under assistant/src must not import
+ * `@anthropic-ai/sdk` directly. Only the canonical provider adapter is
+ * allowed to use the SDK.
+ *
+ * Allowlist entries should be kept minimal — add a path here only if it
+ * genuinely needs to talk to the Anthropic SDK without going through the
+ * provider abstraction.
+ */
+const ALLOWED_FILES = new Set([
+  'assistant/src/providers/anthropic/client.ts',
+]);
+
+describe('no direct @anthropic-ai/sdk imports', () => {
+  test('production files do not import @anthropic-ai/sdk outside allowlist', () => {
+    let grepOutput = '';
+    try {
+      grepOutput = execSync(
+        `git grep -l "@anthropic-ai/sdk" -- 'assistant/src/**/*.ts'`,
+        { encoding: 'utf-8', cwd: process.cwd() + '/..' },
+      ).trim();
+    } catch (err) {
+      // Exit code 1 means no matches — that's the happy path
+      if ((err as { status?: number }).status === 1) {
+        return;
+      }
+      throw err;
+    }
+
+    const files = grepOutput
+      .split('\n')
+      .filter((f) => f.length > 0)
+      // Exclude test files — they legitimately mock the SDK
+      .filter((f) => !f.includes('/__tests__/'));
+    const violations = files.filter((f) => !ALLOWED_FILES.has(f));
+
+    expect(violations).toEqual([]);
+  });
+});

package/src/__tests__/oauth2-gateway-transport.test.ts

@@ -60,6 +60,10 @@ mock.module('../inbound/public-ingress-urls.js', () => ({
   },
 }));
 
+// Track token exchange request
+let lastTokenRequestBody: URLSearchParams | null = null;
+let lastTokenRequestHeaders: Record<string, string> = {};
+
 // Mock fetch for token exchange
 let mockTokenResponse: { ok: boolean; status: number; body: Record<string, unknown> } = {
   ok: true,
@@ -77,6 +81,13 @@ const originalFetch = globalThis.fetch;
 globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
   const url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
   if (url.includes('token')) {
+    // Capture request body and headers for assertions
+    if (init?.body) {
+      lastTokenRequestBody = new URLSearchParams(init.body as string);
+    }
+    if (init?.headers) {
+      lastTokenRequestHeaders = init.headers as Record<string, string>;
+    }
     if (!mockTokenResponse.ok) {
       return new Response(JSON.stringify({ error: 'invalid_grant' }), {
         status: mockTokenResponse.status,
@@ -108,6 +119,8 @@ beforeEach(() => {
   mockPublicBaseUrl = '';
   mockOAuthCallbackUrl = 'https://gw.example.com/webhooks/oauth/callback';
   pendingCallbacks.clear();
+  lastTokenRequestBody = null;
+  lastTokenRequestHeaders = {};
   mockTokenResponse = {
     ok: true,
     status: 200,
@@ -282,4 +295,121 @@ describe('OAuth2 gateway transport', () => {
       await expect(flowPromise).rejects.toThrow('OAuth2 token exchange failed');
     });
   });
+
+  describe('PKCE with client secret', () => {
+    test('includes PKCE params in auth URL even when clientSecret is provided', async () => {
+      mockPublicBaseUrl = 'https://gw.example.com';
+
+      const configWithSecret: OAuth2Config = {
+        ...BASE_OAUTH_CONFIG,
+        clientSecret: 'test-client-secret',
+      };
+
+      let capturedAuthUrl = '';
+      const flowPromise = startOAuth2Flow(configWithSecret, {
+        openUrl: (url) => { capturedAuthUrl = url; },
+      });
+
+      await new Promise((r) => setTimeout(r, 10));
+
+      // Auth URL must include PKCE challenge params despite having a client secret
+      expect(capturedAuthUrl).toContain('code_challenge=');
+      expect(capturedAuthUrl).toContain('code_challenge_method=S256');
+
+      const entries = Array.from(pendingCallbacks.entries());
+      expect(entries.length).toBe(1);
+      entries[0][1].resolve('pkce-with-secret-code');
+
+      const result = await flowPromise;
+      expect(result.tokens.accessToken).toBe('test-access-token');
+
+      // Token exchange must include code_verifier
+      expect(lastTokenRequestBody).not.toBeNull();
+      expect(lastTokenRequestBody!.get('code_verifier')).toBeTruthy();
+    });
+
+    test('sends Basic Auth header and omits client_id/client_secret from body when tokenEndpointAuthMethod is client_secret_basic', async () => {
+      mockPublicBaseUrl = 'https://gw.example.com';
+
+      const configWithSecret: OAuth2Config = {
+        ...BASE_OAUTH_CONFIG,
+        clientSecret: 'test-client-secret',
+        tokenEndpointAuthMethod: 'client_secret_basic',
+      };
+
+      const flowPromise = startOAuth2Flow(configWithSecret, {
+        openUrl: () => {},
+      });
+
+      await new Promise((r) => setTimeout(r, 10));
+
+      const entries = Array.from(pendingCallbacks.entries());
+      entries[0][1].resolve('basic-auth-code');
+
+      await flowPromise;
+
+      // Should send Basic Auth header with base64(client_id:client_secret)
+      const expectedCredentials = Buffer.from('test-client-id:test-client-secret').toString('base64');
+      expect(lastTokenRequestHeaders['Authorization']).toBe(`Basic ${expectedCredentials}`);
+
+      // Body should NOT contain client_id or client_secret
+      expect(lastTokenRequestBody).not.toBeNull();
+      expect(lastTokenRequestBody!.has('client_id')).toBe(false);
+      expect(lastTokenRequestBody!.has('client_secret')).toBe(false);
+
+      // Body should still contain code_verifier
+      expect(lastTokenRequestBody!.get('code_verifier')).toBeTruthy();
+    });
+
+    test('sends client_id and client_secret in body when tokenEndpointAuthMethod is client_secret_post (default)', async () => {
+      mockPublicBaseUrl = 'https://gw.example.com';
+
+      const configWithSecret: OAuth2Config = {
+        ...BASE_OAUTH_CONFIG,
+        clientSecret: 'test-client-secret',
+      };
+
+      const flowPromise = startOAuth2Flow(configWithSecret, {
+        openUrl: () => {},
+      });
+
+      await new Promise((r) => setTimeout(r, 10));
+
+      const entries = Array.from(pendingCallbacks.entries());
+      entries[0][1].resolve('post-auth-code');
+
+      await flowPromise;
+
+      // No Authorization header for client_secret_post
+      expect(lastTokenRequestHeaders['Authorization']).toBeUndefined();
+
+      // Body should contain client_id and client_secret
+      expect(lastTokenRequestBody).not.toBeNull();
+      expect(lastTokenRequestBody!.get('client_id')).toBe('test-client-id');
+      expect(lastTokenRequestBody!.get('client_secret')).toBe('test-client-secret');
+    });
+
+    test('sends client_id in body without Basic Auth when no clientSecret', async () => {
+      mockPublicBaseUrl = 'https://gw.example.com';
+
+      const flowPromise = startOAuth2Flow(BASE_OAUTH_CONFIG, {
+        openUrl: () => {},
+      });
+
+      await new Promise((r) => setTimeout(r, 10));
+
+      const entries = Array.from(pendingCallbacks.entries());
+      entries[0][1].resolve('public-client-code');
+
+      await flowPromise;
+
+      // No Authorization header for public clients
+      expect(lastTokenRequestHeaders['Authorization']).toBeUndefined();
+
+      // Body should contain client_id
+      expect(lastTokenRequestBody).not.toBeNull();
+      expect(lastTokenRequestBody!.get('client_id')).toBe('test-client-id');
+      expect(lastTokenRequestBody!.has('client_secret')).toBe(false);
+    });
+  });
 });

package/src/__tests__/onboarding-starter-tasks.test.ts

@@ -41,6 +41,8 @@ mock.module('../util/logger.js', () => ({
   getLogger: () => new Proxy({} as Record<string, unknown>, {
     get: () => () => {},
   }),
+  isDebug: () => false,
+  truncateForLog: (v: string) => v,
 }));
 
 const { buildStarterTaskPlaybookSection, buildSystemPrompt } = await import('../config/system-prompt.js');

package/src/__tests__/provider-commit-message-generator.test.ts

@@ -55,18 +55,21 @@ const mockProvider: Provider = {
   name: 'mock-provider',
   sendMessage: mockSendMessage,
 };
-let getProviderShouldThrow = false;
-
-mock.module('../providers/registry.js', () => ({
-  getProvider: (_name: string) => {
-    if (getProviderShouldThrow) {
-      throw new Error('Provider not initialized');
-    }
-    return mockProvider;
-  },
-  registerProvider: () => {},
-  listProviders: () => ['mock-provider'],
-  initializeProviders: () => {},
+
+let resolvedProvider: {
+  provider: Provider;
+  configuredProviderName: string;
+  selectedProviderName: string;
+  usedFallbackPrimary: boolean;
+} | null = {
+  provider: mockProvider,
+  configuredProviderName: 'anthropic',
+  selectedProviderName: 'anthropic',
+  usedFallbackPrimary: false,
+};
+
+mock.module('../providers/provider-send-message.js', () => ({
+  resolveConfiguredProvider: () => resolvedProvider,
 }));
 
 // ---------------------------------------------------------------------------
@@ -113,7 +116,12 @@ describe('ProviderCommitMessageGenerator', () => {
     _resetCommitMessageGenerator();
     currentConfig = cloneConfig();
     mockSendMessage.mockReset();
-    getProviderShouldThrow = false;
+    resolvedProvider = {
+      provider: mockProvider,
+      configuredProviderName: 'anthropic',
+      selectedProviderName: 'anthropic',
+      usedFallbackPrimary: false,
+    };
   });
 
   // 1. disabled
@@ -150,6 +158,32 @@ describe('ProviderCommitMessageGenerator', () => {
     expect(mockSendMessage).not.toHaveBeenCalled();
   });
 
+  // 3b. No resolvable provider and no keys
+  test('no resolvable provider + no keys → returns deterministic, reason "missing_provider_api_key"', async () => {
+    currentConfig.apiKeys = {} as Record<string, string>;
+    resolvedProvider = null;
+    const gen = getCommitMessageGenerator();
+    const result = await gen.generateCommitMessage(baseContext, {
+      changedFiles: baseContext.changedFiles,
+    });
+    expect(result.source).toBe('deterministic');
+    expect(result.reason).toBe('missing_provider_api_key');
+    expect(mockSendMessage).not.toHaveBeenCalled();
+  });
+
+  // 3c. No resolvable provider despite keys
+  test('no resolvable provider with keys present → returns deterministic, reason "provider_not_initialized"', async () => {
+    currentConfig.apiKeys = { anthropic: 'sk-test-key' } as Record<string, string>;
+    resolvedProvider = null;
+    const gen = getCommitMessageGenerator();
+    const result = await gen.generateCommitMessage(baseContext, {
+      changedFiles: baseContext.changedFiles,
+    });
+    expect(result.source).toBe('deterministic');
+    expect(result.reason).toBe('provider_not_initialized');
+    expect(mockSendMessage).not.toHaveBeenCalled();
+  });
+
   // 4. breaker open
   test('breaker open → returns deterministic, reason "breaker_open"', async () => {
     // Force the breaker open by simulating enough failures
@@ -295,6 +329,12 @@ describe('ProviderCommitMessageGenerator', () => {
   test('Ollama without API key or fast model → returns deterministic, reason "missing_fast_model"', async () => {
     (currentConfig as Record<string, unknown>).provider = 'ollama';
     currentConfig.apiKeys = {} as Record<string, string>;
+    resolvedProvider = {
+      provider: mockProvider,
+      configuredProviderName: 'ollama',
+      selectedProviderName: 'ollama',
+      usedFallbackPrimary: false,
+    };
     const gen = getCommitMessageGenerator();
     const result = await gen.generateCommitMessage(baseContext, {
       changedFiles: baseContext.changedFiles,
@@ -309,6 +349,12 @@ describe('ProviderCommitMessageGenerator', () => {
   test('Unknown provider without fast model default → returns deterministic, reason "missing_fast_model"', async () => {
     (currentConfig as Record<string, unknown>).provider = 'exotic-provider';
     currentConfig.apiKeys = { 'exotic-provider': 'sk-exotic' } as Record<string, string>;
+    resolvedProvider = {
+      provider: mockProvider,
+      configuredProviderName: 'exotic-provider',
+      selectedProviderName: 'exotic-provider',
+      usedFallbackPrimary: false,
+    };
     const gen = getCommitMessageGenerator();
     const result = await gen.generateCommitMessage(baseContext, {
       changedFiles: baseContext.changedFiles,
@@ -322,6 +368,12 @@ describe('ProviderCommitMessageGenerator', () => {
   test('fast-model override enables LLM path for provider without built-in default', async () => {
     (currentConfig as Record<string, unknown>).provider = 'ollama';
     currentConfig.apiKeys = {} as Record<string, string>; // Ollama is keyless
+    resolvedProvider = {
+      provider: mockProvider,
+      configuredProviderName: 'ollama',
+      selectedProviderName: 'ollama',
+      usedFallbackPrimary: false,
+    };
     currentConfig.workspaceGit.commitMessageLLM.providerFastModelOverrides = {
       ollama: 'llama3.2:3b',
     };
@@ -339,4 +391,28 @@ describe('ProviderCommitMessageGenerator', () => {
     const options = callArgs[3] as { config: { model: string } };
     expect(options.config.model).toBe('llama3.2:3b');
   });
+
+  // 15. Fail-open fallback provider uses fallback provider's fast-model mapping
+  test('configured provider unavailable -> selected fallback provider model mapping is used', async () => {
+    currentConfig.provider = 'anthropic';
+    currentConfig.providerOrder = ['openai'];
+    currentConfig.apiKeys = { openai: 'sk-openai' } as Record<string, string>;
+    resolvedProvider = {
+      provider: mockProvider,
+      configuredProviderName: 'anthropic',
+      selectedProviderName: 'openai',
+      usedFallbackPrimary: true,
+    };
+    mockSendMessage.mockResolvedValueOnce(makeSuccessResponse('fix: fail-open commit'));
+
+    const gen = getCommitMessageGenerator();
+    const result = await gen.generateCommitMessage(baseContext, {
+      changedFiles: baseContext.changedFiles,
+    });
+
+    expect(result.source).toBe('llm');
+    const callArgs = mockSendMessage.mock.calls[0];
+    const options = callArgs[3] as { config: { model: string } };
+    expect(options.config.model).toBe('gpt-4o-mini');
+  });
 });