@vellumai/assistant 0.4.13 → 0.4.15

package/src/__tests__/channel-approval.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from 'bun:test';
 
 import { parseApprovalDecision } from '../runtime/channel-approval-parser.js';
+import { parseCallbackData } from '../runtime/routes/channel-route-shared.js';
 
 // ═══════════════════════════════════════════════════════════════════════════
 // Plain-text approval decision parser
@@ -32,6 +33,48 @@ describe('parseApprovalDecision', () => {
     expect(result!.source).toBe('plain_text');
   });
 
+  // ── Approve for 10 minutes ────────────────────────────────────────
+
+  test.each([
+    'approve for 10 minutes',
+    'Approve for 10 minutes',
+    'APPROVE FOR 10 MINUTES',
+    'allow for 10 minutes',
+    'Allow for 10 minutes',
+    'ALLOW FOR 10 MINUTES',
+    'approve 10m',
+    'Approve 10m',
+    'APPROVE 10M',
+    'allow 10m',
+    'approve 10 min',
+    'allow 10 min',
+  ])('recognises "%s" as approve_10m', (input) => {
+    const result = parseApprovalDecision(input);
+    expect(result).not.toBeNull();
+    expect(result!.action).toBe('approve_10m');
+    expect(result!.source).toBe('plain_text');
+  });
+
+  // ── Approve for thread ────────────────────────────────────────────
+
+  test.each([
+    'approve for thread',
+    'Approve for thread',
+    'APPROVE FOR THREAD',
+    'allow for thread',
+    'Allow for thread',
+    'ALLOW FOR THREAD',
+    'approve thread',
+    'Approve thread',
+    'APPROVE THREAD',
+    'allow thread',
+  ])('recognises "%s" as approve_thread', (input) => {
+    const result = parseApprovalDecision(input);
+    expect(result).not.toBeNull();
+    expect(result!.action).toBe('approve_thread');
+    expect(result!.source).toBe('plain_text');
+  });
+
   // ── Approve always ────────────────────────────────────────────────
 
   test.each([
@@ -130,6 +173,20 @@ describe('parseApprovalDecision', () => {
     expect(result!.requestId).toBe('req-789');
   });
 
+  test('extracts requestId from [ref:...] tag with approve_10m decision', () => {
+    const result = parseApprovalDecision('approve for 10 minutes [ref:req-timer]');
+    expect(result).not.toBeNull();
+    expect(result!.action).toBe('approve_10m');
+    expect(result!.requestId).toBe('req-timer');
+  });
+
+  test('extracts requestId from [ref:...] tag with approve_thread decision', () => {
+    const result = parseApprovalDecision('approve for thread [ref:req-thread]');
+    expect(result).not.toBeNull();
+    expect(result!.action).toBe('approve_thread');
+    expect(result!.requestId).toBe('req-thread');
+  });
+
   test('handles ref tag on separate line', () => {
     const result = parseApprovalDecision('yes\n[ref:req-abc-123]');
     expect(result).not.toBeNull();
@@ -143,3 +200,46 @@ describe('parseApprovalDecision', () => {
     expect(result!.requestId).toBeUndefined();
   });
 });
+
+// ═══════════════════════════════════════════════════════════════════════════
+// Callback data parser
+// ═══════════════════════════════════════════════════════════════════════════
+
+describe('parseCallbackData', () => {
+  test.each([
+    ['apr:req-123:approve_once', 'approve_once'],
+    ['apr:req-123:approve_10m', 'approve_10m'],
+    ['apr:req-123:approve_thread', 'approve_thread'],
+    ['apr:req-123:approve_always', 'approve_always'],
+    ['apr:req-123:reject', 'reject'],
+  ] as const)('parses "%s" as action "%s"', (data, expectedAction) => {
+    const result = parseCallbackData(data);
+    expect(result).not.toBeNull();
+    expect(result!.action).toBe(expectedAction);
+    expect(result!.requestId).toBe('req-123');
+    expect(result!.source).toBe('telegram_button');
+  });
+
+  test('parses whatsapp source channel', () => {
+    const result = parseCallbackData('apr:req-456:approve_10m', 'whatsapp');
+    expect(result).not.toBeNull();
+    expect(result!.action).toBe('approve_10m');
+    expect(result!.source).toBe('whatsapp_button');
+  });
+
+  test('returns null for unknown action', () => {
+    expect(parseCallbackData('apr:req-123:unknown_action')).toBeNull();
+  });
+
+  test('returns null for missing prefix', () => {
+    expect(parseCallbackData('xyz:req-123:approve_once')).toBeNull();
+  });
+
+  test('returns null for incomplete data', () => {
+    expect(parseCallbackData('apr:req-123')).toBeNull();
+  });
+
+  test('returns null for empty requestId', () => {
+    expect(parseCallbackData('apr::approve_once')).toBeNull();
+  });
+});

package/src/__tests__/conversation-routes-guardian-reply.test.ts

@@ -58,11 +58,18 @@ mock.module('../runtime/local-actor-identity.js', () => ({
   resolveLocalIpcGuardianContext: () => ({ trustClass: 'guardian', sourceChannel: 'vellum' }),
 }));
 
+import type { AuthContext } from '../runtime/auth/types.js';
 import { handleSendMessage } from '../runtime/routes/conversation-routes.js';
 
-const testServer = {
-  requestIP: () => ({ address: '127.0.0.1' }),
-} as unknown as import('../runtime/middleware/actor-token.js').ServerWithRequestIP;
+const testAuthContext: AuthContext = {
+  subject: 'actor:self:test-guardian',
+  principalType: 'actor',
+  assistantId: 'self',
+  actorPrincipalId: 'test-guardian',
+  scopeProfile: 'actor_client_v1',
+  scopes: new Set(['chat.read', 'chat.write', 'approval.read', 'approval.write', 'settings.read', 'settings.write', 'attachments.read', 'attachments.write', 'calls.read', 'calls.write', 'feature_flags.read', 'feature_flags.write']),
+  policyEpoch: 1,
+};
 
 describe('handleSendMessage canonical guardian reply interception', () => {
   beforeEach(() => {
@@ -121,7 +128,7 @@ describe('handleSendMessage canonical guardian reply interception', () => {
         assistantEventHub: { publish: async () => {} } as any,
         resolveAttachments: () => [],
       },
-    }, testServer);
+    }, testAuthContext);
 
     expect(res.status).toBe(202);
     const body = await res.json() as { accepted: boolean; messageId?: string };
@@ -184,7 +191,7 @@ describe('handleSendMessage canonical guardian reply interception', () => {
         assistantEventHub: { publish: async () => {} } as any,
         resolveAttachments: () => [],
       },
-    }, testServer);
+    }, testAuthContext);
 
     expect(res.status).toBe(202);
     expect(routeGuardianReplyMock).toHaveBeenCalledTimes(1);
@@ -245,7 +252,7 @@ describe('handleSendMessage canonical guardian reply interception', () => {
         assistantEventHub: { publish: async () => {} } as any,
         resolveAttachments: () => [],
       },
-    }, testServer);
+    }, testAuthContext);
 
     expect(res.status).toBe(202);
     expect(routeGuardianReplyMock).toHaveBeenCalledTimes(1);

package/src/__tests__/conversation-routes.test.ts

@@ -21,11 +21,18 @@ mock.module('../runtime/local-actor-identity.js', () => ({
   resolveLocalIpcGuardianContext: (sourceChannel: string) => ({ trustClass: 'guardian', sourceChannel }),
 }));
 
-import type { ServerWithRequestIP } from '../runtime/middleware/actor-token.js';
+import type { AuthContext } from '../runtime/auth/types.js';
 import { handleSendMessage } from '../runtime/routes/conversation-routes.js';
 
-const mockLoopbackServer: ServerWithRequestIP = {
-  requestIP: () => ({ address: '127.0.0.1', family: 'IPv4', port: 0 }),
+/** Synthetic AuthContext for tests — mimics a local actor with full scopes. */
+const mockAuthContext: AuthContext = {
+  subject: 'actor:self:test-principal',
+  principalType: 'actor',
+  assistantId: 'self',
+  actorPrincipalId: 'test-principal',
+  scopeProfile: 'actor_client_v1',
+  scopes: new Set(['chat.read', 'chat.write', 'approval.read', 'approval.write']),
+  policyEpoch: 1,
 };
 
 describe('handleSendMessage', () => {
@@ -50,7 +57,7 @@ describe('handleSendMessage', () => {
         capturedSourceChannel = sourceChannel;
         return { messageId: 'msg-legacy-fallback' };
       },
-    }, mockLoopbackServer);
+    }, mockAuthContext);
 
     const body = await res.json() as { accepted: boolean; messageId: string };
     expect(res.status).toBe(202);

package/src/__tests__/guardian-actions-endpoint.test.ts

@@ -58,15 +58,22 @@ import {
 import { initializeDb, resetDb } from '../memory/db.js';
 import { getDb } from '../memory/db.js';
 import { conversations } from '../memory/schema.js';
-import type { ServerWithRequestIP } from '../runtime/middleware/actor-token.js';
+import type { AuthContext } from '../runtime/auth/types.js';
 import {
   handleGuardianActionDecision,
   handleGuardianActionsPending,
   listGuardianDecisionPrompts,
 } from '../runtime/routes/guardian-action-routes.js';
 
-const mockLoopbackServer: ServerWithRequestIP = {
-  requestIP: () => ({ address: '127.0.0.1', family: 'IPv4', port: 0 }),
+/** Synthetic AuthContext for tests -- mimics a local actor with full scopes. */
+const mockAuthContext: AuthContext = {
+  subject: 'actor:self:test-principal',
+  principalType: 'actor',
+  assistantId: 'self',
+  actorPrincipalId: 'test-principal',
+  scopeProfile: 'actor_client_v1',
+  scopes: new Set(['chat.read', 'chat.write', 'approval.read', 'approval.write']),
+  policyEpoch: 1,
 };
 
 initializeDb();
@@ -152,7 +159,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ action: 'approve_once' }),
     });
-    const res = await handleGuardianActionDecision(req, mockLoopbackServer);
+    const res = await handleGuardianActionDecision(req, mockAuthContext);
     expect(res.status).toBe(400);
     const body = await res.json();
     expect(body.error.message).toContain('requestId');
@@ -163,7 +170,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ requestId: 'req-1' }),
     });
-    const res = await handleGuardianActionDecision(req, mockLoopbackServer);
+    const res = await handleGuardianActionDecision(req, mockAuthContext);
     expect(res.status).toBe(400);
     const body = await res.json();
     expect(body.error.message).toContain('action');
@@ -174,7 +181,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ requestId: 'req-1', action: 'nuke_from_orbit' }),
     });
-    const res = await handleGuardianActionDecision(req, mockLoopbackServer);
+    const res = await handleGuardianActionDecision(req, mockAuthContext);
     expect(res.status).toBe(400);
     const body = await res.json();
     expect(body.error.message).toContain('Invalid action');
@@ -187,7 +194,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ requestId: 'nonexistent', action: 'approve_once' }),
     });
-    const res = await handleGuardianActionDecision(req, mockLoopbackServer);
+    const res = await handleGuardianActionDecision(req, mockAuthContext);
     expect(res.status).toBe(404);
   });
 
@@ -199,7 +206,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ requestId: 'req-gd-1', action: 'approve_once' }),
     });
-    const res = await handleGuardianActionDecision(req, mockLoopbackServer);
+    const res = await handleGuardianActionDecision(req, mockAuthContext);
     expect(res.status).toBe(200);
     const body = await res.json();
     expect(body.applied).toBe(true);
@@ -214,7 +221,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ requestId: 'req-scope-1', action: 'approve_once', conversationId: 'conv-wrong' }),
     });
-    const res = await handleGuardianActionDecision(req, mockLoopbackServer);
+    const res = await handleGuardianActionDecision(req, mockAuthContext);
     expect(res.status).toBe(404);
     const body = await res.json();
     expect(body.error.message).toContain('No pending guardian action');
@@ -229,7 +236,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ requestId: 'req-scope-2', action: 'reject', conversationId: 'conv-match' }),
     });
-    const res = await handleGuardianActionDecision(req, mockLoopbackServer);
+    const res = await handleGuardianActionDecision(req, mockAuthContext);
     expect(res.status).toBe(200);
     const body = await res.json();
     expect(body.applied).toBe(true);
@@ -243,7 +250,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ requestId: 'req-scope-3', action: 'approve_once' }),
     });
-    const res = await handleGuardianActionDecision(req, mockLoopbackServer);
+    const res = await handleGuardianActionDecision(req, mockAuthContext);
     expect(res.status).toBe(200);
   });
 
@@ -261,7 +268,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ requestId: 'req-access-1', action: 'approve_once' }),
     });
-    const res = await handleGuardianActionDecision(req, mockLoopbackServer);
+    const res = await handleGuardianActionDecision(req, mockAuthContext);
     expect(res.status).toBe(200);
     const body = await res.json();
     expect(body.applied).toBe(true);
@@ -283,7 +290,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ requestId: 'req-voice-access-1', action: 'approve_once' }),
     });
-    const res = await handleGuardianActionDecision(req, mockLoopbackServer);
+    const res = await handleGuardianActionDecision(req, mockAuthContext);
     expect(res.status).toBe(200);
     const body = await res.json();
     expect(body.applied).toBe(true);
@@ -298,7 +305,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ requestId: 'req-stale-1', action: 'approve_once' }),
     });
-    const res = await handleGuardianActionDecision(req, mockLoopbackServer);
+    const res = await handleGuardianActionDecision(req, mockAuthContext);
     const body = await res.json();
     expect(body.applied).toBe(false);
     expect(body.reason).toBe('already_resolved');
@@ -314,7 +321,7 @@ describe('HTTP handleGuardianActionDecision', () => {
       method: 'POST',
       body: JSON.stringify({ requestId: 'req-actor-1', action: 'approve_once' }),
     });
-    await handleGuardianActionDecision(req, mockLoopbackServer);
+    await handleGuardianActionDecision(req, mockAuthContext);
     const call = mockApplyCanonicalGuardianDecision.mock.calls[0]![0] as Record<string, unknown>;
     const actorContext = call.actorContext as Record<string, unknown>;
     expect(actorContext.channel).toBe('vellum');
@@ -330,8 +337,8 @@ describe('HTTP handleGuardianActionsPending', () => {
   beforeEach(resetTables);
 
   test('returns 400 when conversationId is missing', () => {
-    const req = new Request('http://localhost/v1/guardian-actions/pending');
-    const res = handleGuardianActionsPending(req, mockLoopbackServer);
+    const url = new URL('http://localhost/v1/guardian-actions/pending');
+    const res = handleGuardianActionsPending(url, mockAuthContext);
     expect(res.status).toBe(400);
   });
 
@@ -342,8 +349,8 @@ describe('HTTP handleGuardianActionsPending', () => {
       questionText: 'Run bash: ls',
     });
 
-    const req = new Request('http://localhost/v1/guardian-actions/pending?conversationId=conv-list');
-    const res = handleGuardianActionsPending(req, mockLoopbackServer);
+    const url = new URL('http://localhost/v1/guardian-actions/pending?conversationId=conv-list');
+    const res = handleGuardianActionsPending(url, mockAuthContext);
     expect(res.status).toBe(200);
 
     // Verify the prompts directly via the shared helper

package/src/__tests__/mcp-health-check.test.ts

@@ -0,0 +1,65 @@
+import { beforeEach, describe, expect, jest, mock, test } from 'bun:test';
+
+const mockConnect = jest.fn();
+const mockDisconnect = jest.fn();
+let mockIsConnected = true;
+
+mock.module('../mcp/client.js', () => ({
+  McpClient: class {
+    get isConnected() { return mockIsConnected; }
+    connect = mockConnect;
+    disconnect = mockDisconnect;
+  },
+}));
+
+const { checkServerHealth } = await import('../cli/mcp.js');
+
+const serverConfig = (overrides = {}) => ({
+  transport: { type: 'streamable-http' as const, url: 'https://example.com/mcp' },
+  enabled: true,
+  defaultRiskLevel: 'high' as const,
+  maxTools: 20,
+  ...overrides,
+});
+
+describe('checkServerHealth', () => {
+  beforeEach(() => {
+    mockConnect.mockReset();
+    mockDisconnect.mockReset();
+    mockIsConnected = true;
+  });
+
+  test('returns Connected when server connects successfully', async () => {
+    mockConnect.mockResolvedValue(undefined);
+    mockDisconnect.mockResolvedValue(undefined);
+
+    const result = await checkServerHealth('test', serverConfig());
+    expect(result).toContain('Connected');
+    expect(mockDisconnect).toHaveBeenCalled();
+  });
+
+  test('returns Needs authentication when isConnected is false', async () => {
+    mockConnect.mockResolvedValue(undefined);
+    mockIsConnected = false;
+
+    const result = await checkServerHealth('test', serverConfig());
+    expect(result).toContain('Needs authentication');
+  });
+
+  test('returns Error when connect throws', async () => {
+    mockConnect.mockRejectedValue(new Error('Connection refused'));
+    mockDisconnect.mockResolvedValue(undefined);
+
+    const result = await checkServerHealth('test', serverConfig());
+    expect(result).toContain('Error');
+    expect(result).toContain('Connection refused');
+  });
+
+  test('returns Timed out when connect hangs', async () => {
+    mockConnect.mockImplementation(() => new Promise(() => {}));
+    mockDisconnect.mockResolvedValue(undefined);
+
+    const result = await checkServerHealth('test', serverConfig(), 100);
+    expect(result).toContain('Timed out');
+  });
+});

package/src/__tests__/permission-types.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, test } from "bun:test";
+
+import type { UserDecision } from "../permissions/types.js";
+import { isAllowDecision } from "../permissions/types.js";
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("isAllowDecision", () => {
+  const allowDecisions: UserDecision[] = [
+    "allow",
+    "allow_10m",
+    "allow_thread",
+    "always_allow",
+    "always_allow_high_risk",
+    "temporary_override",
+  ];
+
+  for (const decision of allowDecisions) {
+    test(`returns true for '${decision}'`, () => {
+      expect(isAllowDecision(decision)).toBe(true);
+    });
+  }
+
+  test("returns false for 'deny'", () => {
+    expect(isAllowDecision("deny")).toBe(false);
+  });
+
+  test("returns false for 'always_deny'", () => {
+    expect(isAllowDecision("always_deny")).toBe(false);
+  });
+});

package/src/__tests__/scan-result-store.test.ts

@@ -0,0 +1,121 @@
+import { beforeEach, describe, expect, it } from "bun:test";
+
+import {
+  _internals,
+  clearScanStore,
+  getSenderMessageIds,
+  getSenderMetadata,
+  storeScanResult,
+} from "../config/bundled-skills/messaging/tools/scan-result-store.js";
+
+describe("scan-result-store", () => {
+  beforeEach(() => {
+    clearScanStore();
+  });
+
+  const makeSenders = (count: number) =>
+    Array.from({ length: count }, (_, i) => ({
+      id: `sender-${i}`,
+      messageIds: [`msg-${i}-a`, `msg-${i}-b`],
+      newestMessageId: `msg-${i}-a`,
+      newestUnsubscribableMessageId: i % 2 === 0 ? `msg-${i}-a` : null,
+    }));
+
+  it("stores and retrieves message IDs", () => {
+    const senders = makeSenders(3);
+    const scanId = storeScanResult(senders);
+
+    const ids = getSenderMessageIds(scanId, ["sender-0", "sender-2"]);
+    expect(ids).toEqual(["msg-0-a", "msg-0-b", "msg-2-a", "msg-2-b"]);
+  });
+
+  it("returns null for unknown scan ID", () => {
+    expect(getSenderMessageIds("nonexistent", ["sender-0"])).toBeNull();
+  });
+
+  it("returns empty array for unknown sender IDs", () => {
+    const scanId = storeScanResult(makeSenders(1));
+    const ids = getSenderMessageIds(scanId, ["unknown-sender"]);
+    expect(ids).toEqual([]);
+  });
+
+  it("retrieves sender metadata", () => {
+    const senders = makeSenders(2);
+    const scanId = storeScanResult(senders);
+
+    const meta0 = getSenderMetadata(scanId, "sender-0");
+    expect(meta0).toEqual({
+      newestMessageId: "msg-0-a",
+      newestUnsubscribableMessageId: "msg-0-a",
+    });
+
+    const meta1 = getSenderMetadata(scanId, "sender-1");
+    expect(meta1).toEqual({
+      newestMessageId: "msg-1-a",
+      newestUnsubscribableMessageId: null,
+    });
+  });
+
+  it("returns null metadata for unknown sender", () => {
+    const scanId = storeScanResult(makeSenders(1));
+    expect(getSenderMetadata(scanId, "unknown")).toBeNull();
+  });
+
+  it("evicts oldest entry when at capacity (LRU)", () => {
+    const scanIds: string[] = [];
+    for (let i = 0; i < 16; i++) {
+      scanIds.push(
+        storeScanResult([
+          {
+            id: `s-${i}`,
+            messageIds: [`m-${i}`],
+            newestMessageId: `m-${i}`,
+            newestUnsubscribableMessageId: null,
+          },
+        ]),
+      );
+    }
+
+    // All 16 should be present
+    expect(getSenderMessageIds(scanIds[0], ["s-0"])).toEqual(["m-0"]);
+
+    // Adding a 17th should evict the oldest (scanIds[0] was accessed last via getSenderMessageIds, so scanIds[1] is oldest)
+    const newId = storeScanResult([
+      {
+        id: "s-new",
+        messageIds: ["m-new"],
+        newestMessageId: "m-new",
+        newestUnsubscribableMessageId: null,
+      },
+    ]);
+
+    // scanIds[1] should be evicted (it was the LRU after we accessed scanIds[0])
+    expect(getSenderMessageIds(scanIds[1], ["s-1"])).toBeNull();
+    // The new entry and scanIds[0] should still be present
+    expect(getSenderMessageIds(newId, ["s-new"])).toEqual(["m-new"]);
+    expect(getSenderMessageIds(scanIds[0], ["s-0"])).toEqual(["m-0"]);
+  });
+
+  it("expires entries after TTL", () => {
+    const scanId = storeScanResult(makeSenders(1));
+
+    // Manually age the entry beyond TTL
+    const entry = _internals.store.get(scanId);
+    expect(entry).toBeDefined();
+    entry!.createdAt = Date.now() - _internals.TTL_MS - 1;
+
+    expect(getSenderMessageIds(scanId, ["sender-0"])).toBeNull();
+    // Entry should be cleaned up
+    expect(_internals.store.has(scanId)).toBe(false);
+  });
+
+  it("expires entries in getSenderMetadata after TTL", () => {
+    const scanId = storeScanResult(makeSenders(1));
+
+    const entry = _internals.store.get(scanId);
+    entry!.createdAt = Date.now() - _internals.TTL_MS - 1;
+
+    expect(getSenderMetadata(scanId, "sender-0")).toBeNull();
+    expect(_internals.store.has(scanId)).toBe(false);
+  });
+});