@vellumai/assistant 0.3.5 → 0.3.7

package/src/__tests__/checker.test.ts

@@ -1,7 +1,6 @@
 // Smoke command (run all security test files together):
 // bun test src/__tests__/checker.test.ts src/__tests__/trust-store.test.ts src/__tests__/session-skill-tools.test.ts src/__tests__/skill-script-runner-host.test.ts
 
-/* eslint-disable @typescript-eslint/no-explicit-any */
 import { describe, test, expect, beforeAll, beforeEach, afterEach, mock } from 'bun:test';
 import { mkdtempSync, mkdirSync, rmSync, writeFileSync, symlinkSync, realpathSync } from 'node:fs';
 import { tmpdir, homedir } from 'node:os';
@@ -39,9 +38,16 @@ mock.module('../util/logger.js', () => ({
 
 // Mutable config object so tests can switch permissions.mode between
 // 'legacy', 'strict', and 'workspace' without re-registering the mock.
-const testConfig: Record<string, any> = {
-  permissions: { mode: 'legacy' as 'legacy' | 'strict' | 'workspace' },
-  skills: { load: { extraDirs: [] as string[] } },
+interface TestConfig {
+  permissions: { mode: 'legacy' | 'strict' | 'workspace' };
+  skills: { load: { extraDirs: string[] } };
+  sandbox: { enabled: boolean };
+  [key: string]: unknown;
+}
+
+const testConfig: TestConfig = {
+  permissions: { mode: 'legacy' },
+  skills: { load: { extraDirs: [] } },
   sandbox: { enabled: true },
 };
 
@@ -58,6 +64,7 @@ mock.module('../config/loader.js', () => ({
 
 import { classifyRisk, check, generateAllowlistOptions, generateScopeOptions, _resetLegacyDeprecationWarning } from '../permissions/checker.js';
 import { RiskLevel } from '../permissions/types.js';
+import type { TrustRule } from '../permissions/types.js';
 import { addRule, clearCache, findHighestPriorityRule } from '../permissions/trust-store.js';
 import { getDefaultRuleTemplates } from '../permissions/defaults.js';
 import { registerTool, getTool } from '../tools/registry.js';
@@ -2353,13 +2360,13 @@ describe('Permission Checker', () => {
       const trustDir = dirnameFn(trustPath);
       if (!existsSync(trustDir)) mkdirSyncFs(trustDir, { recursive: true });
 
-      let currentRules: any[] = [];
+      let currentRules: TrustRule[] = [];
       try {
         const raw = readFileSync(trustPath, 'utf-8');
         currentRules = JSON.parse(raw).rules ?? [];
       } catch { /* first run */ }
 
-      currentRules = currentRules.filter((r: any) => r.id !== opts.id);
+      currentRules = currentRules.filter((r: TrustRule) => r.id !== opts.id);
       currentRules.push({
         ...opts,
         createdAt: Date.now(),
@@ -2486,7 +2493,7 @@ describe('Permission Checker', () => {
         // Write the executionTarget field directly (addVersionBoundRule doesn't support it)
         const trustPath = join(checkerTestDir, 'protected', 'trust.json');
         const raw = JSON.parse((await import('node:fs')).readFileSync(trustPath, 'utf-8'));
-        const rule = raw.rules.find((r: any) => r.id === 'inv4-target-scoped');
+        const rule = raw.rules.find((r: TrustRule) => r.id === 'inv4-target-scoped');
         rule.executionTarget = '/usr/local/bin/node';
         (await import('node:fs')).writeFileSync(trustPath, JSON.stringify(raw, null, 2));
         clearCache();

package/src/__tests__/clarification-resolver.test.ts

@@ -6,33 +6,53 @@ let llmResolution: 'keep_existing' | 'keep_candidate' | 'merge' | 'still_unclear
 let llmResolvedStatement = '';
 let llmExplanation = 'Unclear response from user.';
 
-mock.module('@anthropic-ai/sdk', () => ({
-  default: class MockAnthropic {
-    messages = {
-      create: async (_body: unknown, opts?: { signal?: AbortSignal }) => {
-        llmCallCount += 1;
-        if (llmDelayMs > 0) {
-          await new Promise((resolve, reject) => {
-            const timer = setTimeout(resolve, llmDelayMs);
-            opts?.signal?.addEventListener('abort', () => {
-              clearTimeout(timer);
-              reject(new Error('Request was aborted.'));
-            });
+mock.module('../providers/provider-send-message.js', () => ({
+  getConfiguredProvider: () => ({
+    sendMessage: async (
+      _messages: unknown,
+      _tools: unknown,
+      _system: unknown,
+      opts?: { signal?: AbortSignal },
+    ) => {
+      llmCallCount += 1;
+      if (llmDelayMs > 0) {
+        await new Promise((resolve, reject) => {
+          const timer = setTimeout(resolve, llmDelayMs);
+          opts?.signal?.addEventListener('abort', () => {
+            clearTimeout(timer);
+            reject(new Error('Request was aborted.'));
           });
-        }
-        return {
-          content: [{
-            type: 'tool_use',
-            input: {
-              resolution: llmResolution,
-              resolved_statement: llmResolvedStatement,
-              explanation: llmExplanation,
-            },
-          }],
-        };
-      },
+        });
+      }
+      return {
+        content: [{
+          type: 'tool_use' as const,
+          id: 'test-tool-use-id',
+          name: 'resolve_conflict',
+          input: {
+            resolution: llmResolution,
+            resolved_statement: llmResolvedStatement,
+            explanation: llmExplanation,
+          },
+        }],
+        model: 'claude-haiku-4-5-20251001',
+        stopReason: 'tool_use',
+        usage: { inputTokens: 0, outputTokens: 0 },
+      };
+    },
+  }),
+  createTimeout: (ms: number) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), ms);
+    return {
+      signal: controller.signal,
+      cleanup: () => clearTimeout(timer),
     };
   },
+  extractToolUse: (response: { content: Array<{ type: string }> }) => {
+    return response.content.find((b: { type: string }) => b.type === 'tool_use');
+  },
+  userMessage: (text: string) => ({ role: 'user', content: [{ type: 'text', text }] }),
 }));
 
 mock.module('../config/loader.js', () => ({

package/src/__tests__/commit-message-enrichment-service.test.ts

@@ -308,25 +308,30 @@ describe('CommitEnrichmentService', () => {
   });
 
   test('job timeout triggers retry with backoff then fails after max retries', async () => {
-    // Use a very short timeout so the real git notes write times out
     const service = new CommitEnrichmentService({
       maxQueueSize: 10,
       maxConcurrency: 1,
-      jobTimeoutMs: 1, // 1ms timeout — will always time out
+      jobTimeoutMs: 10, // short timeout
       maxRetries: 2,
     });
 
     const commitHash = await createCommit();
+
+    // Use a slow gitService so the timeout always wins the race.
+    // A 1ms timeout against a real git write is flaky on fast CI runners.
+    const slowGitService = new WorkspaceGitService(testDir);
+    await slowGitService.ensureInitialized();
+    slowGitService.writeNote = () => new Promise<void>(() => {});
+
     service.enqueue({
       workspaceDir: testDir,
       commitHash,
       context: makeContext(),
-      gitService,
+      gitService: slowGitService,
     });
 
     // Wait for all retries to complete (initial + 2 retries, with backoff)
     // Backoff: 1s after attempt 1, 2s after attempt 2 = ~3s total
-    // But since the job itself is very fast to time out, total time is dominated by backoff
     await waitForDrain(service, 10000);
     await service.shutdown();
 

package/src/__tests__/computer-use-session-working-dir.test.ts

@@ -8,6 +8,13 @@ mock.module('../util/logger.js', () => ({
   getLogger: () => new Proxy({} as Record<string, unknown>, {
     get: () => () => {},
   }),
+  getCliLogger: () => new Proxy({} as Record<string, unknown>, {
+    get: () => () => {},
+  }),
+  isDebug: () => false,
+  truncateForLog: (value: string, maxLen = 500) => value.length > maxLen ? value.slice(0, maxLen) + '...' : value,
+  initLogger: () => {},
+  pruneOldLogFiles: () => 0,
 }));
 
 mock.module('../util/platform.js', () => ({
@@ -38,6 +45,7 @@ mock.module('../util/platform.js', () => ({
   isMacOS: () => false,
   isLinux: () => true,
   isWindows: () => false,
+  readHttpToken: () => null,
 }));
 
 mock.module('../tools/executor.js', () => ({

package/src/__tests__/config-schema.test.ts

@@ -74,9 +74,9 @@ describe('AssistantConfigSchema', () => {
     const result = AssistantConfigSchema.parse({});
     expect(result.provider).toBe('anthropic');
     expect(result.model).toBe('claude-opus-4-6');
-    expect(result.maxTokens).toBe(64000);
+    expect(result.maxTokens).toBe(16000);
     expect(result.apiKeys).toEqual({});
-    expect(result.thinking).toEqual({ enabled: false, budgetTokens: 10000 });
+    expect(result.thinking).toEqual({ enabled: false, budgetTokens: 10000, streamThinking: false });
     expect(result.contextWindow).toEqual({
       enabled: true,
       maxInputTokens: 180000,
@@ -707,6 +707,11 @@ describe('AssistantConfigSchema', () => {
       callerIdentity: {
         allowPerCallOverride: true,
       },
+      verification: {
+        enabled: false,
+        maxAttempts: 3,
+        codeLength: 6,
+      },
     });
   });
 
@@ -1188,8 +1193,8 @@ describe('loadConfig with schema validation', () => {
     const config = loadConfig();
     expect(config.provider).toBe('anthropic');
     expect(config.model).toBe('claude-opus-4-6');
-    expect(config.maxTokens).toBe(64000);
-    expect(config.thinking).toEqual({ enabled: false, budgetTokens: 10000 });
+    expect(config.maxTokens).toBe(16000);
+    expect(config.thinking).toEqual({ enabled: false, budgetTokens: 10000, streamThinking: false });
     expect(config.contextWindow).toEqual({
       enabled: true,
       maxInputTokens: 180000,
@@ -1210,7 +1215,7 @@ describe('loadConfig with schema validation', () => {
   test('falls back to default for invalid maxTokens', () => {
     writeConfig({ maxTokens: -100 });
     const config = loadConfig();
-    expect(config.maxTokens).toBe(64000);
+    expect(config.maxTokens).toBe(16000);
   });
 
   test('falls back to defaults for invalid nested values', () => {
@@ -1235,13 +1240,13 @@ describe('loadConfig with schema validation', () => {
     expect(config.model).toBe('gpt-4');
     expect(config.thinking.enabled).toBe(true);
     expect(config.thinking.budgetTokens).toBe(5000);
-    expect(config.maxTokens).toBe(64000);
+    expect(config.maxTokens).toBe(16000);
   });
 
   test('handles no config file', () => {
     const config = loadConfig();
     expect(config.provider).toBe('anthropic');
-    expect(config.maxTokens).toBe(64000);
+    expect(config.maxTokens).toBe(16000);
   });
 
   test('partial nested objects get defaults for missing fields', () => {

package/src/__tests__/context-window-manager.test.ts

@@ -287,7 +287,7 @@ describe('ContextWindowManager', () => {
     expect(getSummaryFromContextMessage(userMessage)).toBeNull();
   });
 
-  test('skips compaction during cooldown when projected gain is too low', async () => {
+  test('skips compaction during cooldown', async () => {
     const provider = createProvider(() => {
       throw new Error('summarizer should not be called while cooldown skip is active');
     });
@@ -307,7 +307,7 @@ describe('ContextWindowManager', () => {
       lastCompactedAt: Date.now() - 30_000,
     });
     expect(result.compacted).toBe(false);
-    expect(result.reason).toBe('compaction cooldown active with low projected gain');
+    expect(result.reason).toBe('compaction cooldown active');
   });
 
   test('ignores cooldown and compacts under severe token pressure', async () => {
@@ -338,6 +338,34 @@ describe('ContextWindowManager', () => {
     expect(result.reason).toBeUndefined();
   });
 
+  test('force=true bypasses cooldown for context-too-large recovery', async () => {
+    const provider = createProvider(() => ({
+      content: [{ type: 'text', text: '## Goals\n- forced compaction' }],
+      model: 'mock-model',
+      usage: { inputTokens: 60, outputTokens: 12 },
+      stopReason: 'end_turn',
+    }));
+    const manager = new ContextWindowManager(
+      provider,
+      'system prompt',
+      makeConfig({ maxInputTokens: 260, targetInputTokens: 180, preserveRecentUserTurns: 1 }),
+    );
+    const long = 'c'.repeat(220);
+    const history: Message[] = [
+      message('user', `u1 ${long}`),
+      message('assistant', `a1 ${long}`),
+      message('user', `u2 ${long}`),
+    ];
+
+    // Same setup as the cooldown test, but with force=true — should compact.
+    const result = await manager.maybeCompact(history, undefined, {
+      lastCompactedAt: Date.now() - 30_000,
+      force: true,
+    });
+    expect(result.compacted).toBe(true);
+    expect(result.reason).toBeUndefined();
+  });
+
   test('image-heavy payload is no longer underestimated as below-threshold', async () => {
     const provider = createProvider(() => ({
       content: [{ type: 'text', text: '## Goals\n- compacted image-heavy history' }],

package/src/__tests__/contradiction-checker.test.ts

@@ -15,22 +15,37 @@ const classifyRelationshipMock = mock(async () => {
   return {
     content: [
       {
-        type: 'tool_use',
+        type: 'tool_use' as const,
+        id: 'test-tool-use-id',
+        name: 'classify_relationship',
         input: {
           relationship: nextRelationship,
           explanation: nextExplanation,
         },
       },
     ],
+    model: 'claude-haiku-4-5-20251001',
+    stopReason: 'tool_use',
+    usage: { inputTokens: 0, outputTokens: 0 },
   };
 });
 
-mock.module('@anthropic-ai/sdk', () => ({
-  default: class MockAnthropic {
-    messages = {
-      create: classifyRelationshipMock,
+mock.module('../providers/provider-send-message.js', () => ({
+  getConfiguredProvider: () => ({
+    sendMessage: classifyRelationshipMock,
+  }),
+  createTimeout: (ms: number) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), ms);
+    return {
+      signal: controller.signal,
+      cleanup: () => clearTimeout(timer),
     };
   },
+  extractToolUse: (response: { content: Array<{ type: string }> }) => {
+    return response.content.find((b: { type: string }) => b.type === 'tool_use');
+  },
+  userMessage: (text: string) => ({ role: 'user', content: [{ type: 'text', text }] }),
 }));
 
 mock.module('../util/platform.js', () => ({

package/src/__tests__/credential-security-invariants.test.ts

@@ -180,7 +180,10 @@ describe('Invariant 2: no generic plaintext secret read API', () => {
       'tools/credentials/broker.ts',   // brokered credential access
       'tools/network/web-search.ts',   // web search API key lookup
       'daemon/handlers.ts',            // Vercel API token + integration OAuth
-      'daemon/handlers/config.ts',     // Vercel API token + integration OAuth (split handler)
+      'daemon/handlers/config-integrations.ts', // Vercel API token + Twitter integration OAuth
+      'daemon/handlers/config-telegram.ts',     // Telegram bot token management
+      'daemon/handlers/config-twilio.ts',       // Twilio credential management
+      'daemon/handlers/config-ingress.ts',      // Ingress config (reads Twilio credentials for webhook sync)
       'security/token-manager.ts',     // OAuth token refresh flow
       'email/providers/index.ts',      // email provider API key lookup
       'tools/network/script-proxy/session-manager.ts', // proxy credential injection at runtime
@@ -198,6 +201,7 @@ describe('Invariant 2: no generic plaintext secret read API', () => {
       'cli/config-commands.ts',          // CLI config management
       'messaging/providers/telegram-bot/adapter.ts', // Telegram bot token lookup for connectivity check
       'messaging/providers/sms/adapter.ts', // Twilio credential lookup for SMS connectivity check
+      'runtime/channel-readiness-service.ts', // channel readiness probes for SMS/Telegram connectivity
     ]);
 
     const thisDir = dirname(fileURLToPath(import.meta.url));
@@ -313,7 +317,7 @@ describe('Invariant 3: secrets never logged in plaintext', () => {
         const logCallPattern = /log\.\w+\(\{([^}]*)}/g;
         const loggedFields: string[] = [];
         let match;
-        while ((match = logCallPattern.exec(prompterSrc)) !== null) {
+        while ((match = logCallPattern.exec(prompterSrc)) != null) {
           // Collect field names from the structured log object
           const fields = match[1].split(',').map(f => f.trim().split(':')[0].trim());
           loggedFields.push(...fields);