@vellumai/assistant 0.4.26 → 0.4.29

package/src/__tests__/encrypted-store.test.ts

@@ -3,6 +3,7 @@ import {
   chmodSync,
   existsSync,
   mkdirSync,
+  readdirSync,
   readFileSync,
   rmSync,
   statSync,
@@ -13,6 +14,7 @@ import { join } from "node:path";
 import {
   afterAll,
   afterEach,
+  beforeAll,
   beforeEach,
   describe,
   expect,
@@ -54,12 +56,15 @@ const STORE_PATH = join(TEST_DIR, "keys.enc");
 // ---------------------------------------------------------------------------
 
 describe("encrypted-store", () => {
+  beforeAll(() => {
+    mkdirSync(TEST_DIR, { recursive: true });
+  });
+
   beforeEach(() => {
-    // Ensure clean temp directory and point store at it
-    if (existsSync(TEST_DIR)) {
-      rmSync(TEST_DIR, { recursive: true });
+    // Clear content files but preserve the directory structure
+    for (const entry of readdirSync(TEST_DIR)) {
+      rmSync(join(TEST_DIR, entry), { recursive: true, force: true });
     }
-    mkdirSync(TEST_DIR, { recursive: true });
     _setStorePath(STORE_PATH);
   });
 
@@ -68,9 +73,7 @@ describe("encrypted-store", () => {
   });
 
   afterAll(() => {
-    if (existsSync(TEST_DIR)) {
-      rmSync(TEST_DIR, { recursive: true });
-    }
+    rmSync(TEST_DIR, { recursive: true, force: true });
   });
 
   // -----------------------------------------------------------------------

package/src/__tests__/ephemeral-permissions.test.ts

@@ -353,14 +353,14 @@ describe("ephemeral-permissions", () => {
       expect(result.decision).toBe("deny");
     });
 
-    test("proxied bash still prompts in workspace mode", async () => {
+    test("proxied bash follows normal rules in workspace mode (no special-casing)", async () => {
       const result = await check(
         "bash",
         { command: "echo hello", network_mode: "proxied" },
         testDir,
       );
-      expect(result.decision).toBe("prompt");
-      expect(result.reason).toContain("Proxied");
+      // Default allow-bash rule auto-allows; proxied mode is not special-cased.
+      expect(result.decision).toBe("allow");
     });
 
     test("ephemeral task rules + workspace mode: deny rule wins", async () => {

package/src/__tests__/file-edit-tool.test.ts

@@ -25,7 +25,7 @@ function makeContext(workingDir: string): ToolContext {
     workingDir,
     sessionId: "test-session",
     conversationId: "test-conversation",
-    guardianTrustClass: "guardian",
+    trustClass: "guardian",
   };
 }
 

package/src/__tests__/file-read-tool.test.ts

@@ -25,7 +25,7 @@ function makeContext(workingDir: string): ToolContext {
     workingDir,
     sessionId: "test-session",
     conversationId: "test-conversation",
-    guardianTrustClass: "guardian",
+    trustClass: "guardian",
   };
 }
 

package/src/__tests__/file-write-tool.test.ts

@@ -26,7 +26,7 @@ function makeContext(workingDir: string): ToolContext {
     workingDir,
     sessionId: "test-session",
     conversationId: "test-conversation",
-    guardianTrustClass: "guardian",
+    trustClass: "guardian",
   };
 }
 

package/src/__tests__/fixtures/credential-security-fixtures.ts

@@ -6,7 +6,7 @@
  */
 
 // Test-only value assembled to avoid pre-commit false positives
-const TEST_CREDENTIAL = ['inject', '-test-', '1234'].join('');
+const TEST_CREDENTIAL = ["inject", "-test-", "1234"].join("");
 
 // ---------------------------------------------------------------------------
 // 1. Context Injection — secrets must never enter LLM context
@@ -15,7 +15,11 @@ const TEST_CREDENTIAL = ['inject', '-test-', '1234'].join('');
 export interface ContextInjectionCase {
   label: string;
   /** Where the credential might leak into context */
-  vector: 'tool_output' | 'history_message' | 'confirmation_payload' | 'lifecycle_event';
+  vector:
+    | "tool_output"
+    | "history_message"
+    | "confirmation_payload"
+    | "lifecycle_event";
   /** Tool or action that handles the credential */
   tool: string;
   /** Input that triggers credential handling */
@@ -26,31 +30,45 @@ export interface ContextInjectionCase {
 
 export const contextInjectionCases: ContextInjectionCase[] = [
   {
-    label: 'credential_store store action output',
-    vector: 'tool_output',
-    tool: 'credential_store',
-    input: { action: 'store', service: 'github', field: 'token', value: TEST_CREDENTIAL },
+    label: "credential_store store action output",
+    vector: "tool_output",
+    tool: "credential_store",
+    input: {
+      action: "store",
+      service: "github",
+      field: "token",
+      value: TEST_CREDENTIAL,
+    },
     forbiddenValue: TEST_CREDENTIAL,
   },
   {
-    label: 'credential_store list action output',
-    vector: 'tool_output',
-    tool: 'credential_store',
-    input: { action: 'list' },
+    label: "credential_store list action output",
+    vector: "tool_output",
+    tool: "credential_store",
+    input: { action: "list" },
     forbiddenValue: TEST_CREDENTIAL,
   },
   {
-    label: 'browser_fill_credential result',
-    vector: 'tool_output',
-    tool: 'browser_fill_credential',
-    input: { service: 'github', field: 'token', selector: 'input[name="token"]' },
+    label: "browser_fill_credential result",
+    vector: "tool_output",
+    tool: "browser_fill_credential",
+    input: {
+      service: "github",
+      field: "token",
+      selector: 'input[name="token"]',
+    },
     forbiddenValue: TEST_CREDENTIAL,
   },
   {
-    label: 'confirmation_request payload for credential_store',
-    vector: 'confirmation_payload',
-    tool: 'credential_store',
-    input: { action: 'store', service: 'github', field: 'token', value: TEST_CREDENTIAL },
+    label: "confirmation_request payload for credential_store",
+    vector: "confirmation_payload",
+    tool: "credential_store",
+    input: {
+      action: "store",
+      service: "github",
+      field: "token",
+      value: TEST_CREDENTIAL,
+    },
     forbiddenValue: TEST_CREDENTIAL,
   },
 ];
@@ -69,9 +87,9 @@ export interface DirectReadCase {
 
 export const directReadCases: DirectReadCase[] = [
   {
-    label: 'vault.ts getCredentialValue',
-    modulePath: 'tools/credentials/vault',
-    exportName: 'getCredentialValue',
+    label: "vault.ts getCredentialValue",
+    modulePath: "tools/credentials/vault",
+    exportName: "getCredentialValue",
   },
 ];
 
@@ -82,31 +100,31 @@ export const directReadCases: DirectReadCase[] = [
 export interface LogLeakageCase {
   label: string;
   /** Component where logging might leak credentials */
-  component: 'daemon_handler' | 'prompter' | 'tool_executor' | 'ipc_decode';
+  component: "daemon_handler" | "prompter" | "tool_executor" | "ipc_decode";
   /** Description of what log output is checked */
   logCheck: string;
 }
 
 export const logLeakageCases: LogLeakageCase[] = [
   {
-    label: 'response handler does not log value',
-    component: 'daemon_handler',
-    logCheck: 'credential value not in log output',
+    label: "response handler does not log value",
+    component: "daemon_handler",
+    logCheck: "credential value not in log output",
   },
   {
-    label: 'prompter does not log response value',
-    component: 'prompter',
-    logCheck: 'resolved credential not logged',
+    label: "prompter does not log response value",
+    component: "prompter",
+    logCheck: "resolved credential not logged",
   },
   {
-    label: 'tool executor lifecycle events redact sensitive fields',
-    component: 'tool_executor',
-    logCheck: 'password/token/value fields masked',
+    label: "tool executor lifecycle events redact sensitive fields",
+    component: "tool_executor",
+    logCheck: "password/token/value fields masked",
   },
   {
-    label: 'IPC decode failure does not dump raw line',
-    component: 'ipc_decode',
-    logCheck: 'malformed line not logged verbatim',
+    label: "IPC decode failure does not dump raw line",
+    component: "ipc_decode",
+    logCheck: "malformed line not logged verbatim",
   },
 ];
 
@@ -117,7 +135,12 @@ export const logLeakageCases: LogLeakageCase[] = [
 export interface PolicyMisuseCase {
   label: string;
   /** Type of policy violation */
-  violation: 'none' | 'wrong_tool' | 'wrong_domain' | 'missing_policy' | 'empty_allowlist';
+  violation:
+    | "none"
+    | "wrong_tool"
+    | "wrong_domain"
+    | "missing_policy"
+    | "empty_allowlist";
   credentialId: string;
   requestingTool: string;
   requestDomain?: string;
@@ -131,51 +154,51 @@ export interface PolicyMisuseCase {
 
 export const policyMisuseCases: PolicyMisuseCase[] = [
   {
-    label: 'browser_fill_credential denied when tool not in allowedTools',
-    violation: 'wrong_tool',
-    credentialId: 'cred-001',
-    requestingTool: 'browser_fill_credential',
-    allowedTools: ['some_other_tool'],
-    allowedDomains: ['example.com'],
+    label: "browser_fill_credential denied when tool not in allowedTools",
+    violation: "wrong_tool",
+    credentialId: "cred-001",
+    requestingTool: "browser_fill_credential",
+    allowedTools: ["some_other_tool"],
+    allowedDomains: ["example.com"],
     expectedDenied: true,
   },
   {
-    label: 'browser_fill_credential denied when domain not in allowedDomains',
-    violation: 'wrong_domain',
-    credentialId: 'cred-002',
-    requestingTool: 'browser_fill_credential',
-    requestDomain: 'evil.com',
-    allowedTools: ['browser_fill_credential'],
-    allowedDomains: ['example.com'],
+    label: "browser_fill_credential denied when domain not in allowedDomains",
+    violation: "wrong_domain",
+    credentialId: "cred-002",
+    requestingTool: "browser_fill_credential",
+    requestDomain: "evil.com",
+    allowedTools: ["browser_fill_credential"],
+    allowedDomains: ["example.com"],
     expectedDenied: true,
   },
   {
-    label: 'credential with no policy defaults to deny',
-    violation: 'missing_policy',
-    credentialId: 'cred-003',
-    requestingTool: 'browser_fill_credential',
+    label: "credential with no policy defaults to deny",
+    violation: "missing_policy",
+    credentialId: "cred-003",
+    requestingTool: "browser_fill_credential",
     allowedTools: [],
     allowedDomains: [],
     expectedDenied: true,
   },
   {
-    label: 'credential with empty allowlist denied',
-    violation: 'empty_allowlist',
-    credentialId: 'cred-004',
-    requestingTool: 'browser_fill_credential',
-    requestDomain: 'example.com',
+    label: "credential with empty allowlist denied",
+    violation: "empty_allowlist",
+    credentialId: "cred-004",
+    requestingTool: "browser_fill_credential",
+    requestDomain: "example.com",
     allowedTools: [],
     allowedDomains: [],
     expectedDenied: true,
   },
   {
-    label: 'browser_fill_credential allowed when tool and domain match',
-    violation: 'none',
-    credentialId: 'cred-005',
-    requestingTool: 'browser_fill_credential',
-    requestDomain: 'login.example.com',
-    allowedTools: ['browser_fill_credential'],
-    allowedDomains: ['example.com'],
+    label: "browser_fill_credential allowed when tool and domain match",
+    violation: "none",
+    credentialId: "cred-005",
+    requestingTool: "browser_fill_credential",
+    requestDomain: "login.example.com",
+    allowedTools: ["browser_fill_credential"],
+    allowedDomains: ["example.com"],
     expectedDenied: false,
   },
 ];

package/src/__tests__/fixtures/media-reuse-fixtures.ts

@@ -5,8 +5,8 @@
  * response helpers used by the proxy and asset tool test suites.
  */
 
-import type { StoredAttachment } from '../../memory/attachments-store.js';
-import type { UserDecision } from '../../permissions/types.js';
+import type { StoredAttachment } from "../../memory/attachments-store.js";
+import type { UserDecision } from "../../permissions/types.js";
 
 // ---------------------------------------------------------------------------
 // Fake attachment data
@@ -14,13 +14,13 @@ import type { UserDecision } from '../../permissions/types.js';
 
 /** A tiny 1x1 red PNG pixel, base64-encoded. */
 export const TINY_PNG_BASE64 =
-  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PchI7wAAAABJRU5ErkJggg==';
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PchI7wAAAABJRU5ErkJggg==";
 
 /** A tiny 1x1 JPEG pixel, base64-encoded. */
 export const TINY_JPEG_BASE64 =
-  '/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMCwsKCwsM' +
-  'CgwMDQwMCwwMDQsLCwwODQoMEAwMEQ4ODwwLDgz/2wBDAQMEBAUEBQkFBQkMCwkLDAwMDAwMDAwMDAwM' +
-  'DAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAz/wAARCAABAAEDASIAAhEBAxEB/8QAFAABAAAAAAAAAAAAAAAAAAAACf/EABQQAQAAAAAAAAAAAAAAAAAAAAD/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/8QAFBEBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEQMRAD8AKwA//9k=';
+  "/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMCwsKCwsM" +
+  "CgwMDQwMCwwMDQsLCwwODQoMEAwMEQ4ODwwLDgz/2wBDAQMEBAUEBQkFBQkMCwkLDAwMDAwMDAwMDAwM" +
+  "DAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAz/wAARCAABAAEDASIAAhEBAxEB/8QAFAABAAAAAAAAAAAAAAAAAAAACf/EABQQAQAAAAAAAAAAAAAAAAAAAAD/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/8QAFBEBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEQMRAD8AKwA//9k=";
 
 // ---------------------------------------------------------------------------
 // Deterministic attachment records
@@ -30,33 +30,33 @@ const NOW = 1700000000000;
 
 /** A fake selfie image attachment with deterministic IDs. */
 export const FAKE_SELFIE_ATTACHMENT: StoredAttachment = {
-  id: 'att-selfie-001',
-  originalFilename: 'selfie.png',
-  mimeType: 'image/png',
-  sizeBytes: Buffer.from(TINY_PNG_BASE64, 'base64').length,
-  kind: 'image',
+  id: "att-selfie-001",
+  originalFilename: "selfie.png",
+  mimeType: "image/png",
+  sizeBytes: Buffer.from(TINY_PNG_BASE64, "base64").length,
+  kind: "image",
   thumbnailBase64: null,
   createdAt: NOW,
 };
 
 /** A fake document attachment. */
 export const FAKE_DOCUMENT_ATTACHMENT: StoredAttachment = {
-  id: 'att-doc-001',
-  originalFilename: 'report.pdf',
-  mimeType: 'application/pdf',
+  id: "att-doc-001",
+  originalFilename: "report.pdf",
+  mimeType: "application/pdf",
   sizeBytes: 4096,
-  kind: 'document',
+  kind: "document",
   thumbnailBase64: null,
   createdAt: NOW,
 };
 
 /** A fake JPEG photo attachment. */
 export const FAKE_PHOTO_ATTACHMENT: StoredAttachment = {
-  id: 'att-photo-001',
-  originalFilename: 'photo.jpg',
-  mimeType: 'image/jpeg',
-  sizeBytes: Buffer.from(TINY_JPEG_BASE64, 'base64').length,
-  kind: 'image',
+  id: "att-photo-001",
+  originalFilename: "photo.jpg",
+  mimeType: "image/jpeg",
+  sizeBytes: Buffer.from(TINY_JPEG_BASE64, "base64").length,
+  kind: "image",
   thumbnailBase64: null,
   createdAt: NOW,
 };
@@ -74,17 +74,17 @@ export interface FakeMessageLink {
 
 /** A deterministic message-attachment link for the selfie. */
 export const FAKE_SELFIE_LINK: FakeMessageLink = {
-  messageId: 'msg-001',
+  messageId: "msg-001",
   attachmentId: FAKE_SELFIE_ATTACHMENT.id,
-  conversationId: 'conv-001',
+  conversationId: "conv-001",
   position: 0,
 };
 
 /** A second link showing multiple attachments on one message. */
 export const FAKE_DOCUMENT_LINK: FakeMessageLink = {
-  messageId: 'msg-001',
+  messageId: "msg-001",
   attachmentId: FAKE_DOCUMENT_ATTACHMENT.id,
-  conversationId: 'conv-001',
+  conversationId: "conv-001",
   position: 1,
 };
 
@@ -102,25 +102,31 @@ export interface FakeApprovalResponse {
 
 /** Returns a one-shot allow decision. */
 export function fakeAllowOnce(): FakeApprovalResponse {
-  return { decision: 'allow' };
+  return { decision: "allow" };
 }
 
 /** Returns a deny decision. */
 export function fakeDeny(): FakeApprovalResponse {
-  return { decision: 'deny' };
+  return { decision: "deny" };
 }
 
 /** Returns an "always allow" decision with a pattern for the trust rule. */
-export function fakeAlwaysAllow(pattern: string, scope = '/tmp/test-project'): FakeApprovalResponse {
-  return { decision: 'always_allow', pattern, scope };
+export function fakeAlwaysAllow(
+  pattern: string,
+  scope = "/tmp/test-project",
+): FakeApprovalResponse {
+  return { decision: "always_allow", pattern, scope };
 }
 
 /** Returns an "always allow high risk" decision. */
-export function fakeAlwaysAllowHighRisk(pattern: string, scope = '/tmp/test-project'): FakeApprovalResponse {
-  return { decision: 'always_allow_high_risk', pattern, scope };
+export function fakeAlwaysAllowHighRisk(
+  pattern: string,
+  scope = "/tmp/test-project",
+): FakeApprovalResponse {
+  return { decision: "always_allow_high_risk", pattern, scope };
 }
 
 /** Returns an "always deny" decision. */
 export function fakeAlwaysDeny(): FakeApprovalResponse {
-  return { decision: 'always_deny' };
+  return { decision: "always_deny" };
 }