@vellumai/assistant 0.4.15 → 0.4.17

package/src/__tests__/channel-guardian.test.ts

@@ -51,6 +51,7 @@ mock.module("../messaging/providers/sms/client.js", () => ({
 }));
 
 mock.module("../config/env.js", () => ({
+  isHttpAuthDisabled: () => true,
   getGatewayInternalBaseUrl: () => "http://127.0.0.1:7830",
 }));
 

package/src/__tests__/conversation-attention-telegram.test.ts

@@ -1,31 +1,33 @@
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 
-import { afterAll, beforeEach, describe, expect, mock, test } from 'bun:test';
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+mock.module("../config/env.js", () => ({ isHttpAuthDisabled: () => true }));
 
 // ---------------------------------------------------------------------------
 // Test isolation: in-memory SQLite via temp directory
 // ---------------------------------------------------------------------------
 
-const testDir = mkdtempSync(join(tmpdir(), 'conv-attn-telegram-test-'));
+const testDir = mkdtempSync(join(tmpdir(), "conv-attn-telegram-test-"));
 
-mock.module('../util/platform.js', () => ({
+mock.module("../util/platform.js", () => ({
   getRootDir: () => testDir,
   getDataDir: () => testDir,
-  isMacOS: () => process.platform === 'darwin',
-  isLinux: () => process.platform === 'linux',
-  isWindows: () => process.platform === 'win32',
-  getSocketPath: () => join(testDir, 'test.sock'),
-  getPidPath: () => join(testDir, 'test.pid'),
-  getDbPath: () => join(testDir, 'test.db'),
-  getLogPath: () => join(testDir, 'test.log'),
+  isMacOS: () => process.platform === "darwin",
+  isLinux: () => process.platform === "linux",
+  isWindows: () => process.platform === "win32",
+  getSocketPath: () => join(testDir, "test.sock"),
+  getPidPath: () => join(testDir, "test.pid"),
+  getDbPath: () => join(testDir, "test.db"),
+  getLogPath: () => join(testDir, "test.log"),
   ensureDataDir: () => {},
   migrateToDataLayout: () => {},
   migrateToWorkspaceLayout: () => {},
 }));
 
-mock.module('../util/logger.js', () => ({
+mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
@@ -35,29 +37,29 @@ mock.module('../util/logger.js', () => ({
 }));
 
 // Mock security check to always pass
-mock.module('../security/secret-ingress.js', () => ({
+mock.module("../security/secret-ingress.js", () => ({
   checkIngressForSecrets: () => ({ blocked: false }),
 }));
 
 // Mock render to return the raw content as text
-mock.module('../daemon/handlers.js', () => ({
+mock.module("../daemon/handlers.js", () => ({
   renderHistoryContent: (content: unknown) => ({
-    text: typeof content === 'string' ? content : JSON.stringify(content),
+    text: typeof content === "string" ? content : JSON.stringify(content),
   }),
 }));
 
 // Mock ingress member store to return an active member for all lookups
-mock.module('../memory/ingress-member-store.js', () => ({
+mock.module("../memory/ingress-member-store.js", () => ({
   findMember: () => ({
-    id: 'member-test-default',
-    assistantId: 'self',
-    sourceChannel: 'telegram',
-    externalUserId: 'telegram-user-default',
+    id: "member-test-default",
+    assistantId: "self",
+    sourceChannel: "telegram",
+    externalUserId: "telegram-user-default",
     externalChatId: null,
     displayName: null,
     username: null,
-    status: 'active',
-    policy: 'allow',
+    status: "active",
+    policy: "allow",
     inviteId: null,
     createdBySessionId: null,
     revokedReason: null,
@@ -70,17 +72,17 @@ mock.module('../memory/ingress-member-store.js', () => ({
   upsertMember: () => {},
 }));
 
-import { eq } from 'drizzle-orm';
+import { eq } from "drizzle-orm";
 
-import * as channelDeliveryStore from '../memory/channel-delivery-store.js';
-import { getDb, initializeDb, resetDb } from '../memory/db.js';
+import * as channelDeliveryStore from "../memory/channel-delivery-store.js";
+import { getDb, initializeDb, resetDb } from "../memory/db.js";
 import {
   attachments,
   conversationAssistantAttentionState,
   conversationAttentionEvents,
-} from '../memory/schema.js';
-import * as pendingInteractions from '../runtime/pending-interactions.js';
-import { handleChannelInbound } from '../runtime/routes/channel-routes.js';
+} from "../memory/schema.js";
+import * as pendingInteractions from "../runtime/pending-interactions.js";
+import { handleChannelInbound } from "../runtime/routes/channel-routes.js";
 
 initializeDb();
 
@@ -101,42 +103,42 @@ function resetTables(): void {
   const db = getDb();
   db.delete(conversationAttentionEvents).run();
   db.delete(conversationAssistantAttentionState).run();
-  db.run('DELETE FROM channel_guardian_approval_requests');
-  db.run('DELETE FROM channel_guardian_verification_challenges');
-  db.run('DELETE FROM channel_guardian_bindings');
-  db.run('DELETE FROM conversation_keys');
-  db.run('DELETE FROM message_runs');
-  db.run('DELETE FROM channel_inbound_events');
-  db.run('DELETE FROM messages');
-  db.run('DELETE FROM conversations');
+  db.run("DELETE FROM channel_guardian_approval_requests");
+  db.run("DELETE FROM channel_guardian_verification_challenges");
+  db.run("DELETE FROM channel_guardian_bindings");
+  db.run("DELETE FROM conversation_keys");
+  db.run("DELETE FROM message_runs");
+  db.run("DELETE FROM channel_inbound_events");
+  db.run("DELETE FROM messages");
+  db.run("DELETE FROM conversations");
   channelDeliveryStore.resetAllRunDeliveryClaims();
   pendingInteractions.clear();
 }
 
-const TEST_BEARER_TOKEN = 'token';
+const TEST_BEARER_TOKEN = "token";
 
 function makeInboundRequest(overrides: Record<string, unknown> = {}): Request {
   const body = {
-    sourceChannel: 'telegram',
-    interface: 'telegram',
-    conversationExternalId: 'chat-123',
-    actorExternalId: 'telegram-user-default',
+    sourceChannel: "telegram",
+    interface: "telegram",
+    conversationExternalId: "chat-123",
+    actorExternalId: "telegram-user-default",
     externalMessageId: `msg-${Date.now()}-${Math.random()}`,
-    content: 'hello',
-    replyCallbackUrl: 'https://gateway.test/deliver',
+    content: "hello",
+    replyCallbackUrl: "https://gateway.test/deliver",
     ...overrides,
   };
-  return new Request('http://localhost/channels/inbound', {
-    method: 'POST',
+  return new Request("http://localhost/channels/inbound", {
+    method: "POST",
     headers: {
-      'Content-Type': 'application/json',
-      'X-Gateway-Origin': TEST_BEARER_TOKEN,
+      "Content-Type": "application/json",
+      "X-Gateway-Origin": TEST_BEARER_TOKEN,
     },
     body: JSON.stringify(body),
   });
 }
 
-const noopProcessMessage = mock(async () => ({ messageId: 'msg-1' }));
+const noopProcessMessage = mock(async () => ({ messageId: "msg-1" }));
 
 function getAttentionEvents(conversationId: string) {
   const db = getDb();
@@ -156,11 +158,15 @@ beforeEach(() => {
 // Telegram inbound messages record inferred seen signals
 // ═══════════════════════════════════════════════════════════════════════════
 
-describe('Telegram inbound message seen signals', () => {
-  test('records inferred seen signal for non-duplicate text message', async () => {
-    const req = makeInboundRequest({ content: 'Hello there!' });
+describe("Telegram inbound message seen signals", () => {
+  test("records inferred seen signal for non-duplicate text message", async () => {
+    const req = makeInboundRequest({ content: "Hello there!" });
 
-    const res = await handleChannelInbound(req, noopProcessMessage, TEST_BEARER_TOKEN);
+    const res = await handleChannelInbound(
+      req,
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
     const body = (await res.json()) as Record<string, unknown>;
 
     expect(body.accepted).toBe(true);
@@ -169,7 +175,7 @@ describe('Telegram inbound message seen signals', () => {
     // Find the conversation ID from inbound events
     const db = getDb();
     const inboundEvents = db.$client
-      .prepare('SELECT conversation_id FROM channel_inbound_events')
+      .prepare("SELECT conversation_id FROM channel_inbound_events")
       .all() as Array<{ conversation_id: string }>;
     expect(inboundEvents.length).toBeGreaterThan(0);
 
@@ -177,56 +183,64 @@ describe('Telegram inbound message seen signals', () => {
     const events = getAttentionEvents(conversationId);
 
     expect(events.length).toBe(1);
-    expect(events[0].signalType).toBe('telegram_inbound_message');
-    expect(events[0].confidence).toBe('inferred');
-    expect(events[0].sourceChannel).toBe('telegram');
-    expect(events[0].source).toBe('inbound-message-handler');
+    expect(events[0].signalType).toBe("telegram_inbound_message");
+    expect(events[0].confidence).toBe("inferred");
+    expect(events[0].sourceChannel).toBe("telegram");
+    expect(events[0].source).toBe("inbound-message-handler");
     expect(events[0].evidenceText).toBe("User sent message: 'Hello there!'");
   });
 
-  test('records inferred seen signal for media attachment without text', async () => {
+  test("records inferred seen signal for media attachment without text", async () => {
     // Insert a fake attachment directly so the handler's validation passes
     const db = getDb();
     const attachmentId = `att-${Date.now()}`;
     db.insert(attachments)
       .values({
         id: attachmentId,
-        originalFilename: 'photo.jpg',
-        mimeType: 'image/jpeg',
+        originalFilename: "photo.jpg",
+        mimeType: "image/jpeg",
         sizeBytes: 1024,
-        kind: 'base64',
-        dataBase64: 'dGVzdA==',
+        kind: "base64",
+        dataBase64: "dGVzdA==",
         createdAt: Date.now(),
       })
       .run();
 
     const req = makeInboundRequest({
-      content: '',
+      content: "",
       attachmentIds: [attachmentId],
     });
 
-    const res = await handleChannelInbound(req, noopProcessMessage, TEST_BEARER_TOKEN);
+    const res = await handleChannelInbound(
+      req,
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
     const body = (await res.json()) as Record<string, unknown>;
 
     expect(body.accepted).toBe(true);
     expect(body.duplicate).toBe(false);
 
     const inboundEvents2 = db.$client
-      .prepare('SELECT conversation_id FROM channel_inbound_events')
+      .prepare("SELECT conversation_id FROM channel_inbound_events")
       .all() as Array<{ conversation_id: string }>;
     const conversationId = inboundEvents2[0].conversation_id;
     const events = getAttentionEvents(conversationId);
 
     expect(events.length).toBe(1);
-    expect(events[0].signalType).toBe('telegram_inbound_message');
-    expect(events[0].evidenceText).toBe('User sent media attachment');
+    expect(events[0].signalType).toBe("telegram_inbound_message");
+    expect(events[0].evidenceText).toBe("User sent media attachment");
   });
 
-  test('evidence text is correctly truncated for long messages', async () => {
-    const longMessage = 'A'.repeat(120);
+  test("evidence text is correctly truncated for long messages", async () => {
+    const longMessage = "A".repeat(120);
     const req = makeInboundRequest({ content: longMessage });
 
-    const res = await handleChannelInbound(req, noopProcessMessage, TEST_BEARER_TOKEN);
+    const res = await handleChannelInbound(
+      req,
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
     const body = (await res.json()) as Record<string, unknown>;
 
     expect(body.accepted).toBe(true);
@@ -234,15 +248,17 @@ describe('Telegram inbound message seen signals', () => {
 
     const db = getDb();
     const inboundEvents = db.$client
-      .prepare('SELECT conversation_id FROM channel_inbound_events')
+      .prepare("SELECT conversation_id FROM channel_inbound_events")
       .all() as Array<{ conversation_id: string }>;
     const conversationId = inboundEvents[0].conversation_id;
     const events = getAttentionEvents(conversationId);
 
     expect(events.length).toBe(1);
     // 80 chars of 'A' + '...'
-    const expectedPreview = 'A'.repeat(80) + '...';
-    expect(events[0].evidenceText).toBe(`User sent message: '${expectedPreview}'`);
+    const expectedPreview = "A".repeat(80) + "...";
+    expect(events[0].evidenceText).toBe(
+      `User sent message: '${expectedPreview}'`,
+    );
   });
 });
 
@@ -250,42 +266,51 @@ describe('Telegram inbound message seen signals', () => {
 // Telegram callbacks record inferred seen signals
 // ═══════════════════════════════════════════════════════════════════════════
 
-describe('Telegram callback seen signals', () => {
-  test('records inferred seen signal for handled callback', async () => {
+describe("Telegram callback seen signals", () => {
+  test("records inferred seen signal for handled callback", async () => {
     // First, send a regular message to establish the conversation
-    const initReq = makeInboundRequest({ content: 'init' });
+    const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage, TEST_BEARER_TOKEN);
 
     const db = getDb();
     const inboundEvents = db.$client
-      .prepare('SELECT conversation_id FROM channel_inbound_events')
+      .prepare("SELECT conversation_id FROM channel_inbound_events")
       .all() as Array<{ conversation_id: string }>;
     const conversationId = inboundEvents[0].conversation_id;
 
     // Register a pending interaction so the approval interception handles it
     const handleConfirmationResponse = mock(() => {});
-    const mockSession = { handleConfirmationResponse } as unknown as import('../daemon/session.js').Session;
-    pendingInteractions.register('req-cb-test', {
+    const mockSession = {
+      handleConfirmationResponse,
+    } as unknown as import("../daemon/session.js").Session;
+    pendingInteractions.register("req-cb-test", {
       session: mockSession,
       conversationId,
-      kind: 'confirmation',
+      kind: "confirmation",
       confirmationDetails: {
-        toolName: 'shell',
-        input: { command: 'echo hello' },
-        riskLevel: 'high',
-        allowlistOptions: [{ label: 'echo hello', description: 'echo hello', pattern: 'echo hello' }],
-        scopeOptions: [{ label: 'everywhere', scope: 'everywhere' }],
+        toolName: "shell",
+        input: { command: "echo hello" },
+        riskLevel: "high",
+        allowlistOptions: [
+          {
+            label: "echo hello",
+            description: "echo hello",
+            pattern: "echo hello",
+          },
+        ],
+        scopeOptions: [{ label: "everywhere", scope: "everywhere" }],
       },
     });
 
     // Create a guardian binding so approval can be handled
-    const { createBinding } = await import('../memory/channel-guardian-store.js');
+    const { createBinding } =
+      await import("../memory/channel-guardian-store.js");
     createBinding({
-      assistantId: 'self',
-      channel: 'telegram',
-      guardianExternalUserId: 'telegram-user-default',
-      guardianDeliveryChatId: 'chat-123',
-      guardianPrincipalId: 'telegram-user-default',
+      assistantId: "self",
+      channel: "telegram",
+      guardianExternalUserId: "telegram-user-default",
+      guardianDeliveryChatId: "chat-123",
+      guardianPrincipalId: "telegram-user-default",
     });
 
     // Clear attention events from the init message
@@ -293,11 +318,15 @@ describe('Telegram callback seen signals', () => {
 
     // Send callback data that matches the pending approval
     const cbReq = makeInboundRequest({
-      content: 'approve',
-      callbackData: 'apr:req-cb-test:approve_once',
+      content: "approve",
+      callbackData: "apr:req-cb-test:approve_once",
     });
 
-    const res = await handleChannelInbound(cbReq, noopProcessMessage, TEST_BEARER_TOKEN);
+    const res = await handleChannelInbound(
+      cbReq,
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
     const body = (await res.json()) as Record<string, unknown>;
 
     expect(body.accepted).toBe(true);
@@ -305,11 +334,13 @@ describe('Telegram callback seen signals', () => {
 
     const events = getAttentionEvents(conversationId);
     expect(events.length).toBe(1);
-    expect(events[0].signalType).toBe('telegram_callback');
-    expect(events[0].confidence).toBe('inferred');
-    expect(events[0].sourceChannel).toBe('telegram');
-    expect(events[0].source).toBe('inbound-message-handler');
-    expect(events[0].evidenceText).toContain("User tapped callback: 'apr:req-cb-test:approve_once'");
+    expect(events[0].signalType).toBe("telegram_callback");
+    expect(events[0].confidence).toBe("inferred");
+    expect(events[0].sourceChannel).toBe("telegram");
+    expect(events[0].source).toBe("inbound-message-handler");
+    expect(events[0].evidenceText).toContain(
+      "User tapped callback: 'apr:req-cb-test:approve_once'",
+    );
   });
 });
 
@@ -317,32 +348,40 @@ describe('Telegram callback seen signals', () => {
 // Duplicate events do NOT produce duplicate seen signals
 // ═══════════════════════════════════════════════════════════════════════════
 
-describe('duplicate event deduplication', () => {
-  test('duplicate Telegram message does not record a second seen signal', async () => {
+describe("duplicate event deduplication", () => {
+  test("duplicate Telegram message does not record a second seen signal", async () => {
     const fixedMessageId = `msg-dedup-${Date.now()}`;
 
     // First (non-duplicate) message
     const req1 = makeInboundRequest({
-      content: 'first message',
+      content: "first message",
       externalMessageId: fixedMessageId,
     });
-    const res1 = await handleChannelInbound(req1, noopProcessMessage, TEST_BEARER_TOKEN);
+    const res1 = await handleChannelInbound(
+      req1,
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
     const body1 = (await res1.json()) as Record<string, unknown>;
     expect(body1.duplicate).toBe(false);
 
     // Same externalMessageId => duplicate
     const req2 = makeInboundRequest({
-      content: 'first message',
+      content: "first message",
       externalMessageId: fixedMessageId,
     });
-    const res2 = await handleChannelInbound(req2, noopProcessMessage, TEST_BEARER_TOKEN);
+    const res2 = await handleChannelInbound(
+      req2,
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
     const body2 = (await res2.json()) as Record<string, unknown>;
     expect(body2.duplicate).toBe(true);
 
     // Only one attention event should exist
     const db = getDb();
     const inboundEvents = db.$client
-      .prepare('SELECT conversation_id FROM channel_inbound_events')
+      .prepare("SELECT conversation_id FROM channel_inbound_events")
       .all() as Array<{ conversation_id: string }>;
     const conversationId = inboundEvents[0].conversation_id;
     const events = getAttentionEvents(conversationId);
@@ -355,16 +394,20 @@ describe('duplicate event deduplication', () => {
 // Non-Telegram channels do NOT record Telegram seen signals
 // ═══════════════════════════════════════════════════════════════════════════
 
-describe('non-Telegram channel filtering', () => {
-  test('SMS inbound message does not record a Telegram seen signal', async () => {
+describe("non-Telegram channel filtering", () => {
+  test("SMS inbound message does not record a Telegram seen signal", async () => {
     // Override ingress member store for SMS channel
     const req = makeInboundRequest({
-      sourceChannel: 'sms',
-      interface: 'sms',
-      content: 'sms message',
+      sourceChannel: "sms",
+      interface: "sms",
+      content: "sms message",
     });
 
-    const res = await handleChannelInbound(req, noopProcessMessage, TEST_BEARER_TOKEN);
+    const res = await handleChannelInbound(
+      req,
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
     const body = (await res.json()) as Record<string, unknown>;
 
     expect(body.accepted).toBe(true);