@vellumai/assistant 0.4.26 → 0.4.30

package/src/__tests__/ipc-snapshot.test.ts

@@ -33,6 +33,12 @@ const clientMessages: Record<ClientMessageType, ClientMessage> = {
     selectedPattern: "bash:npm *",
     selectedScope: "/projects/my-app",
   },
+  contacts: {
+    type: "contacts",
+    action: "list",
+    role: "guardian",
+    limit: 50,
+  },
   session_list: {
     type: "session_list",
   },
@@ -289,6 +295,10 @@ const clientMessages: Record<ClientMessageType, ClientMessage> = {
     type: "app_open_request",
     appId: "app-001",
   },
+  app_delete: {
+    type: "app_delete",
+    appId: "app-001",
+  },
   apps_list: {
     type: "apps_list",
   },
@@ -585,25 +595,14 @@ const clientMessages: Record<ClientMessageType, ClientMessage> = {
       cursorInTextField: true,
     },
   },
-  ingress_invite: {
-    type: "ingress_invite",
+  contacts_invite: {
+    type: "contacts_invite",
     action: "create",
     sourceChannel: "telegram",
     note: "Test invite",
     maxUses: 5,
     expiresInMs: 86400000,
   },
-  ingress_member: {
-    type: "ingress_member",
-    action: "upsert",
-    sourceChannel: "telegram",
-    externalUserId: "user-123",
-    externalChatId: "chat-456",
-    displayName: "Test User",
-    username: "testuser",
-    policy: "allow",
-    status: "active",
-  },
   assistant_inbox_escalation: {
     type: "assistant_inbox_escalation",
     action: "list",
@@ -789,6 +788,14 @@ const serverMessages: Record<ServerMessageType, ServerMessage> = {
     causedByRequestId: "req-003",
     decisionText: "approve",
   },
+  contacts_response: {
+    type: "contacts_response",
+    success: true,
+    contacts: [],
+  },
+  contacts_changed: {
+    type: "contacts_changed",
+  },
   assistant_activity_state: {
     type: "assistant_activity_state",
     sessionId: "sess-001",
@@ -1221,6 +1228,12 @@ const serverMessages: Record<ServerMessageType, ServerMessage> = {
       },
     ],
   },
+  schedule_thread_created: {
+    type: "schedule_thread_created",
+    conversationId: "conv-sched-001",
+    scheduleJobId: "sched-job-001",
+    title: "Daily standup reminder",
+  },
   schedules_list_response: {
     type: "schedules_list_response",
     schedules: [
@@ -1333,6 +1346,10 @@ const serverMessages: Record<ServerMessageType, ServerMessage> = {
       },
     ],
   },
+  app_delete_response: {
+    type: "app_delete_response",
+    success: true,
+  },
   shared_app_delete_response: {
     type: "shared_app_delete_response",
     success: true,
@@ -1843,8 +1860,8 @@ const serverMessages: Record<ServerMessageType, ServerMessage> = {
     mode: "dictation",
     actionPlan: undefined,
   },
-  ingress_invite_response: {
-    type: "ingress_invite_response",
+  contacts_invite_response: {
+    type: "contacts_invite_response",
     success: true,
     invite: {
       id: "inv-001",
@@ -1859,22 +1876,6 @@ const serverMessages: Record<ServerMessageType, ServerMessage> = {
       createdAt: 1700000000,
     },
   },
-  ingress_member_response: {
-    type: "ingress_member_response",
-    success: true,
-    member: {
-      id: "mem-001",
-      sourceChannel: "telegram",
-      externalUserId: "user-123",
-      externalChatId: "chat-456",
-      displayName: "Test User",
-      username: "testuser",
-      status: "active",
-      policy: "allow",
-      lastSeenAt: 1700000000,
-      createdAt: 1700000000,
-    },
-  },
   assistant_inbox_escalation_response: {
     type: "assistant_inbox_escalation_response",
     success: true,

package/src/__tests__/managed-skill-lifecycle.test.ts

@@ -91,7 +91,7 @@ function makeContext(): ToolContext {
     workingDir: "/tmp",
     sessionId: "test-session",
     conversationId: "test-conversation",
-    guardianTrustClass: "guardian",
+    trustClass: "guardian",
   };
 }
 

package/src/__tests__/mcp-cli.test.ts

@@ -1,4 +1,3 @@
-import { spawnSync } from "node:child_process";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -8,49 +7,129 @@ import {
   beforeEach,
   describe,
   expect,
+  mock,
   test,
 } from "bun:test";
 
-const CLI = join(import.meta.dir, "..", "index.ts");
+import { Command } from "commander";
+
+// ── Module mocks (must precede imports that pull them in) ──────────────
+
+let stdoutLines: string[] = [];
+let stderrLines: string[] = [];
+
+mock.module("../util/logger.js", () => ({
+  getCliLogger: () => ({
+    info: (...args: unknown[]) => {
+      stdoutLines.push(args.map(String).join(" "));
+    },
+    error: (...args: unknown[]) => {
+      stderrLines.push(args.map(String).join(" "));
+    },
+    warn: () => {},
+    debug: () => {},
+    trace: () => {},
+    fatal: () => {},
+  }),
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+mock.module("../mcp/mcp-oauth-provider.js", () => ({
+  deleteMcpOAuthCredentials: async () => {},
+  McpOAuthProvider: class {},
+}));
+
+mock.module("../mcp/client.js", () => ({
+  McpClient: class {
+    async connect() {
+      throw new Error("Connection refused");
+    }
+    async disconnect() {}
+    get isConnected() {
+      return false;
+    }
+  },
+}));
+
+const { registerMcpCommand } = await import("../cli/mcp.js");
+
+// ── Helpers ───────────────────────────────────────────────────────────
 
 let testDataDir: string;
 let configPath: string;
 
-function runMcp(
+function writeConfig(config: Record<string, unknown>): void {
+  writeFileSync(configPath, JSON.stringify(config), "utf-8");
+}
+
+function readConfig(): Record<string, unknown> {
+  return JSON.parse(readFileSync(configPath, "utf-8"));
+}
+
+async function runMcp(
   subcommand: string,
   args: string[] = [],
-): { stdout: string; stderr: string; exitCode: number } {
-  const result = spawnSync("bun", ["run", CLI, "mcp", subcommand, ...args], {
-    encoding: "utf-8",
-    timeout: 10_000,
-    env: { ...process.env, BASE_DATA_DIR: testDataDir },
-  });
-  return {
-    stdout: (result.stdout ?? "").toString(),
-    stderr: (result.stderr ?? "").toString(),
-    exitCode: result.status ?? 1,
-  };
+): Promise<{ stdout: string; stderr: string; exitCode: number }> {
+  stdoutLines = [];
+  stderrLines = [];
+  process.exitCode = 0;
+
+  const stdoutWrites: string[] = [];
+  const origWrite = process.stdout.write.bind(process.stdout);
+  const origExit = process.exit;
+
+  // Capture process.stdout.write (used by --json output)
+  process.stdout.write = ((data: unknown) => {
+    stdoutWrites.push(typeof data === "string" ? data : String(data));
+    return true;
+  }) as typeof process.stdout.write;
+
+  // Override process.exit to not kill the process
+  process.exit = ((code?: number) => {
+    if (code !== undefined) process.exitCode = code;
+  }) as typeof process.exit;
+
+  // Point config loader at the test data dir
+  process.env.BASE_DATA_DIR = testDataDir;
+
+  try {
+    const program = new Command();
+    program.exitOverride();
+    registerMcpCommand(program);
+    await program.parseAsync(["node", "vellum", "mcp", subcommand, ...args]);
+  } catch (e: unknown) {
+    // Commander exitOverride throws on parse errors
+    if (e && typeof e === "object" && "exitCode" in e) {
+      process.exitCode = (e as { exitCode: number }).exitCode;
+    } else {
+      throw e;
+    }
+  } finally {
+    process.stdout.write = origWrite;
+    process.exit = origExit;
+  }
+
+  const stdout = [...stdoutLines, ...stdoutWrites].join("\n");
+  const stderr = stderrLines.join("\n");
+  return { stdout, stderr, exitCode: (process.exitCode as number) ?? 0 };
 }
 
-function runMcpList(args: string[] = []) {
+async function runMcpList(args: string[] = []) {
   return runMcp("list", args);
 }
 
-function runMcpAdd(name: string, args: string[]) {
+async function runMcpAdd(name: string, args: string[]) {
   return runMcp("add", [name, ...args]);
 }
 
-function runMcpRemove(name: string) {
+async function runMcpRemove(name: string) {
   return runMcp("remove", [name]);
 }
 
-function writeConfig(config: Record<string, unknown>): void {
-  writeFileSync(configPath, JSON.stringify(config), "utf-8");
-}
-
-function readConfig(): Record<string, unknown> {
-  return JSON.parse(readFileSync(configPath, "utf-8"));
-}
+// ── Tests ─────────────────────────────────────────────────────────────
 
 describe("vellum mcp list", () => {
   beforeAll(() => {
@@ -72,13 +151,13 @@ describe("vellum mcp list", () => {
     writeConfig({});
   });
 
-  test("shows message when no MCP servers configured", () => {
-    const { stdout, exitCode } = runMcpList();
+  test("shows message when no MCP servers configured", async () => {
+    const { stdout, exitCode } = await runMcpList();
     expect(exitCode).toBe(0);
     expect(stdout).toContain("No MCP servers configured");
   });
 
-  test("lists configured servers", () => {
+  test("lists configured servers", async () => {
     writeConfig({
       mcp: {
         servers: {
@@ -94,7 +173,7 @@ describe("vellum mcp list", () => {
       },
     });
 
-    const { stdout, exitCode } = runMcpList();
+    const { stdout, exitCode } = await runMcpList();
     expect(exitCode).toBe(0);
     expect(stdout).toContain("1 MCP server(s) configured");
     expect(stdout).toContain("test-server");
@@ -103,7 +182,7 @@ describe("vellum mcp list", () => {
     expect(stdout).toContain("medium");
   });
 
-  test("shows disabled status", () => {
+  test("shows disabled status", async () => {
     writeConfig({
       mcp: {
         servers: {
@@ -116,12 +195,12 @@ describe("vellum mcp list", () => {
       },
     });
 
-    const { stdout, exitCode } = runMcpList();
+    const { stdout, exitCode } = await runMcpList();
     expect(exitCode).toBe(0);
     expect(stdout).toContain("disabled");
   });
 
-  test("shows stdio command info", () => {
+  test("shows stdio command info", async () => {
     writeConfig({
       mcp: {
         servers: {
@@ -138,15 +217,15 @@ describe("vellum mcp list", () => {
       },
     });
 
-    const { stdout, exitCode } = runMcpList();
+    const { stdout, exitCode } = await runMcpList();
     expect(exitCode).toBe(0);
     expect(stdout).toContain("stdio-server");
     expect(stdout).toContain("stdio");
     expect(stdout).toContain("npx -y some-mcp-server");
     expect(stdout).toContain("low");
-  }, 15_000);
+  });
 
-  test("--json outputs valid JSON", () => {
+  test("--json outputs valid JSON", async () => {
     writeConfig({
       mcp: {
         servers: {
@@ -162,7 +241,7 @@ describe("vellum mcp list", () => {
       },
     });
 
-    const { stdout, exitCode } = runMcpList(["--json"]);
+    const { stdout, exitCode } = await runMcpList(["--json"]);
     expect(exitCode).toBe(0);
     const parsed = JSON.parse(stdout);
     expect(Array.isArray(parsed)).toBe(true);
@@ -171,8 +250,8 @@ describe("vellum mcp list", () => {
     expect(parsed[0].transport.url).toBe("https://example.com/mcp");
   });
 
-  test("--json outputs empty array when no servers", () => {
-    const { stdout, exitCode } = runMcpList(["--json"]);
+  test("--json outputs empty array when no servers", async () => {
+    const { stdout, exitCode } = await runMcpList(["--json"]);
     expect(exitCode).toBe(0);
     const parsed = JSON.parse(stdout);
     expect(parsed).toEqual([]);
@@ -199,8 +278,8 @@ describe("vellum mcp add", () => {
     writeConfig({});
   });
 
-  test("adds a streamable-http server", () => {
-    const { stdout, exitCode } = runMcpAdd("test-http", [
+  test("adds a streamable-http server", async () => {
+    const { stdout, exitCode } = await runMcpAdd("test-http", [
       "-t",
       "streamable-http",
       "-u",
@@ -226,8 +305,8 @@ describe("vellum mcp add", () => {
     expect(server.enabled).toBe(true);
   });
 
-  test("adds a stdio server with args", () => {
-    const { stdout, exitCode } = runMcpAdd("test-stdio", [
+  test("adds a stdio server with args", async () => {
+    const { stdout, exitCode } = await runMcpAdd("test-stdio", [
       "-t",
       "stdio",
       "-c",
@@ -251,8 +330,8 @@ describe("vellum mcp add", () => {
     expect(transport.args).toEqual(["-y", "some-server"]);
   });
 
-  test("adds server as disabled with --disabled flag", () => {
-    const { exitCode } = runMcpAdd("test-disabled", [
+  test("adds server as disabled with --disabled flag", async () => {
+    const { exitCode } = await runMcpAdd("test-disabled", [
       "-t",
       "sse",
       "-u",
@@ -268,7 +347,7 @@ describe("vellum mcp add", () => {
     expect(server.enabled).toBe(false);
   });
 
-  test("rejects duplicate server name", () => {
+  test("rejects duplicate server name", async () => {
     writeConfig({
       mcp: {
         servers: {
@@ -281,7 +360,7 @@ describe("vellum mcp add", () => {
       },
     });
 
-    const { stderr } = runMcpAdd("existing", [
+    const { stderr } = await runMcpAdd("existing", [
       "-t",
       "sse",
       "-u",
@@ -290,18 +369,18 @@ describe("vellum mcp add", () => {
     expect(stderr).toContain("already exists");
   });
 
-  test("rejects stdio without --command", () => {
-    const { stderr } = runMcpAdd("bad-stdio", ["-t", "stdio"]);
+  test("rejects stdio without --command", async () => {
+    const { stderr } = await runMcpAdd("bad-stdio", ["-t", "stdio"]);
     expect(stderr).toContain("--command is required");
   });
 
-  test("rejects streamable-http without --url", () => {
-    const { stderr } = runMcpAdd("bad-http", ["-t", "streamable-http"]);
+  test("rejects streamable-http without --url", async () => {
+    const { stderr } = await runMcpAdd("bad-http", ["-t", "streamable-http"]);
     expect(stderr).toContain("--url is required");
   });
 
-  test("defaults risk to high", () => {
-    const { exitCode } = runMcpAdd("default-risk", [
+  test("defaults risk to high", async () => {
+    const { exitCode } = await runMcpAdd("default-risk", [
       "-t",
       "sse",
       "-u",
@@ -339,7 +418,7 @@ describe("vellum mcp remove", () => {
     writeConfig({});
   });
 
-  test("removes an existing server", () => {
+  test("removes an existing server", async () => {
     writeConfig({
       mcp: {
         servers: {
@@ -352,7 +431,7 @@ describe("vellum mcp remove", () => {
       },
     });
 
-    const { stdout, exitCode } = runMcpRemove("my-server");
+    const { stdout, exitCode } = await runMcpRemove("my-server");
     expect(exitCode).toBe(0);
     expect(stdout).toContain('Removed MCP server "my-server"');
 
@@ -362,13 +441,13 @@ describe("vellum mcp remove", () => {
     expect(servers?.["my-server"]).toBeUndefined();
   });
 
-  test("errors when server does not exist", () => {
-    const { stderr, exitCode } = runMcpRemove("nonexistent");
+  test("errors when server does not exist", async () => {
+    const { stderr, exitCode } = await runMcpRemove("nonexistent");
     expect(exitCode).toBe(1);
     expect(stderr).toContain("not found");
   });
 
-  test("preserves other servers when removing one", () => {
+  test("preserves other servers when removing one", async () => {
     writeConfig({
       mcp: {
         servers: {
@@ -389,7 +468,7 @@ describe("vellum mcp remove", () => {
       },
     });
 
-    const { exitCode } = runMcpRemove("remove-me");
+    const { exitCode } = await runMcpRemove("remove-me");
     expect(exitCode).toBe(0);
 
     const updated = readConfig();

package/src/__tests__/mcp-client-auth.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, jest, mock, test } from "bun:test";
+
+// Mock secure-keys so McpOAuthProvider doesn't try to access the keychain
+mock.module("../security/secure-keys.js", () => ({
+  getSecureKeyAsync: jest.fn().mockResolvedValue(null),
+  setSecureKeyAsync: jest.fn().mockResolvedValue(undefined),
+  deleteSecureKeyAsync: jest.fn().mockResolvedValue(undefined),
+}));
+
+const { McpClient } = await import("../mcp/client.js");
+
+/**
+ * Mimics the SDK's StreamableHTTPError which has a `.code` property
+ * containing the HTTP status code, but doesn't include it in `.message`.
+ */
+class FakeStreamableHTTPError extends Error {
+  code: number;
+  constructor(code: number, message: string) {
+    super(`Streamable HTTP error: ${message}`);
+    this.code = code;
+  }
+}
+
+const httpTransport = {
+  type: "streamable-http" as const,
+  url: "https://example.com/mcp",
+};
+
+describe("McpClient auth error detection", () => {
+  test("treats StreamableHTTPError with code 401 as auth error (does not throw)", async () => {
+    const client = new McpClient("test-server");
+
+    // Monkey-patch createTransport to throw a 401 StreamableHTTPError
+    (client as any).createTransport = () => ({});
+    (client as any).client = {
+      connect: () => {
+        throw new FakeStreamableHTTPError(
+          401,
+          'Error POSTing to endpoint: {"error":"invalid_token"}',
+        );
+      },
+      close: async () => {},
+    };
+
+    // Should NOT throw — auth errors are swallowed, isConnected stays false
+    await client.connect(httpTransport);
+    expect(client.isConnected).toBe(false);
+  });
+
+  test("treats StreamableHTTPError with code 403 as auth error (does not throw)", async () => {
+    const client = new McpClient("test-server");
+
+    (client as any).createTransport = () => ({});
+    (client as any).client = {
+      connect: () => {
+        throw new FakeStreamableHTTPError(403, "Forbidden");
+      },
+      close: async () => {},
+    };
+
+    await client.connect(httpTransport);
+    expect(client.isConnected).toBe(false);
+  });
+
+  test("rethrows non-auth StreamableHTTPError for HTTP transports", async () => {
+    const client = new McpClient("test-server");
+
+    (client as any).createTransport = () => ({});
+    (client as any).client = {
+      connect: () => {
+        throw new FakeStreamableHTTPError(500, "Internal Server Error");
+      },
+      close: async () => {},
+    };
+
+    await expect(client.connect(httpTransport)).rejects.toThrow(
+      "Internal Server Error",
+    );
+  });
+
+  test("treats error message containing 'unauthorized' as auth error", async () => {
+    const client = new McpClient("test-server");
+
+    (client as any).createTransport = () => ({});
+    (client as any).client = {
+      connect: () => {
+        throw new Error("unauthorized request");
+      },
+      close: async () => {},
+    };
+
+    await client.connect(httpTransport);
+    expect(client.isConnected).toBe(false);
+  });
+});

package/src/__tests__/media-generate-image.test.ts

@@ -93,9 +93,9 @@ mock.module("../memory/conversation-store.js", () => ({
     totalEstimatedCost: 0,
     title: null,
   }),
-  provenanceFromGuardianContext: () => ({
+  provenanceFromTrustContext: () => ({
     source: "user",
-    guardianContext: undefined,
+    trustContext: undefined,
   }),
   getConversationOriginInterface: () => null,
   getConversationOriginChannel: () => null,

package/src/__tests__/media-reuse-story.e2e.test.ts

@@ -264,7 +264,7 @@ describe("Story E2E: selfie yesterday -> generated image today", () => {
       workingDir: sandboxDir,
       sessionId: "sess-story",
       conversationId: threadB.id,
-      guardianTrustClass: "guardian",
+      trustClass: "guardian",
     };
 
     const result = await assetSearchTool.execute(
@@ -283,7 +283,7 @@ describe("Story E2E: selfie yesterday -> generated image today", () => {
       workingDir: sandboxDir,
       sessionId: "sess-story",
       conversationId: threadB.id,
-      guardianTrustClass: "guardian",
+      trustClass: "guardian",
     };
 
     const result = await assetSearchTool.execute(
@@ -300,7 +300,7 @@ describe("Story E2E: selfie yesterday -> generated image today", () => {
       workingDir: sandboxDir,
       sessionId: "sess-story",
       conversationId: threadB.id,
-      guardianTrustClass: "guardian",
+      trustClass: "guardian",
     };
 
     const result = await assetMaterializeTool.execute(
@@ -328,7 +328,7 @@ describe("Story E2E: selfie yesterday -> generated image today", () => {
       workingDir: sandboxDir,
       sessionId: "sess-story",
       conversationId: threadB.id,
-      guardianTrustClass: "guardian",
+      trustClass: "guardian",
     };
 
     // Step 3a: Search for the selfie
@@ -532,7 +532,7 @@ describe("Private-thread variant: cross-thread media blocking", () => {
       workingDir: sandboxDir,
       sessionId: "sess-priv-test",
       conversationId: standardThread.id,
-      guardianTrustClass: "guardian",
+      trustClass: "guardian",
     };
 
     const result = await assetSearchTool.execute(
@@ -560,7 +560,7 @@ describe("Private-thread variant: cross-thread media blocking", () => {
       workingDir: sandboxDir,
       sessionId: "sess-priv-test",
       conversationId: standardThread.id,
-      guardianTrustClass: "guardian",
+      trustClass: "guardian",
     };
 
     const result = await assetMaterializeTool.execute(
@@ -591,7 +591,7 @@ describe("Private-thread variant: cross-thread media blocking", () => {
       workingDir: sandboxDir,
       sessionId: "sess-priv-test",
       conversationId: privateThread.id,
-      guardianTrustClass: "guardian",
+      trustClass: "guardian",
     };
 
     const searchResult = await assetSearchTool.execute(
@@ -636,7 +636,7 @@ describe("Private-thread variant: cross-thread media blocking", () => {
       workingDir: sandboxDir,
       sessionId: "sess-priv-test",
       conversationId: privateThreadB.id,
-      guardianTrustClass: "guardian",
+      trustClass: "guardian",
     };
 
     const searchResult = await assetSearchTool.execute(