@vellumai/assistant 0.4.35 → 0.4.37

package/src/__tests__/guardian-outbound-http.test.ts

@@ -195,21 +195,24 @@ beforeEach(() => {
 // ===========================================================================
 
 describe("startOutbound", () => {
-  test("SMS: returns missing_destination when destination is absent", () => {
-    const result = startOutbound({ channel: "sms" });
+  test("SMS: returns missing_destination when destination is absent", async () => {
+    const result = await startOutbound({ channel: "sms" });
     expect(result.success).toBe(false);
     expect(result.error).toBe("missing_destination");
     expect(result.channel).toBe("sms");
   });
 
-  test("SMS: returns invalid_destination for garbage phone number", () => {
-    const result = startOutbound({ channel: "sms", destination: "notaphone" });
+  test("SMS: returns invalid_destination for garbage phone number", async () => {
+    const result = await startOutbound({
+      channel: "sms",
+      destination: "notaphone",
+    });
     expect(result.success).toBe(false);
     expect(result.error).toBe("invalid_destination");
   });
 
-  test("SMS: succeeds with valid E.164 number", () => {
-    const result = startOutbound({
+  test("SMS: succeeds with valid E.164 number", async () => {
+    const result = await startOutbound({
       channel: "sms",
       destination: "+15551234567",
     });
@@ -222,8 +225,8 @@ describe("startOutbound", () => {
     expect(result.channel).toBe("sms");
   });
 
-  test("SMS: succeeds with loose phone format (parentheses + dashes)", () => {
-    const result = startOutbound({
+  test("SMS: succeeds with loose phone format (parentheses + dashes)", async () => {
+    const result = await startOutbound({
       channel: "sms",
       destination: "(555) 987-6543",
     });
@@ -231,14 +234,14 @@ describe("startOutbound", () => {
     expect(result.verificationSessionId).toBeDefined();
   });
 
-  test("Telegram: returns missing_destination when absent", () => {
-    const result = startOutbound({ channel: "telegram" });
+  test("Telegram: returns missing_destination when absent", async () => {
+    const result = await startOutbound({ channel: "telegram" });
     expect(result.success).toBe(false);
     expect(result.error).toBe("missing_destination");
   });
 
-  test("Telegram: succeeds with numeric chat ID", () => {
-    const result = startOutbound({
+  test("Telegram: succeeds with numeric chat ID", async () => {
+    const result = await startOutbound({
       channel: "telegram",
       destination: "123456789",
     });
@@ -248,8 +251,8 @@ describe("startOutbound", () => {
     expect(result.sendCount).toBe(1);
   });
 
-  test("Telegram: returns invalid_destination for negative (group) chat ID", () => {
-    const result = startOutbound({
+  test("Telegram: returns invalid_destination for negative (group) chat ID", async () => {
+    const result = await startOutbound({
       channel: "telegram",
       destination: "-100123456",
     });
@@ -257,8 +260,8 @@ describe("startOutbound", () => {
     expect(result.error).toBe("invalid_destination");
   });
 
-  test("Telegram: returns pending_bootstrap for handle destination", () => {
-    const result = startOutbound({
+  test("Telegram: returns pending_bootstrap for handle destination", async () => {
+    const result = await startOutbound({
       channel: "telegram",
       destination: "@someuser",
     });
@@ -270,9 +273,9 @@ describe("startOutbound", () => {
     expect(result.secret).toBeUndefined();
   });
 
-  test("Telegram: returns no_bot_username when bot not configured", () => {
+  test("Telegram: returns no_bot_username when bot not configured", async () => {
     mockBotUsername = undefined;
-    const result = startOutbound({
+    const result = await startOutbound({
       channel: "telegram",
       destination: "@someuser",
     });
@@ -280,20 +283,23 @@ describe("startOutbound", () => {
     expect(result.error).toBe("no_bot_username");
   });
 
-  test("voice: returns missing_destination when absent", () => {
-    const result = startOutbound({ channel: "voice" });
+  test("voice: returns missing_destination when absent", async () => {
+    const result = await startOutbound({ channel: "voice" });
     expect(result.success).toBe(false);
     expect(result.error).toBe("missing_destination");
   });
 
-  test("voice: returns invalid_destination for garbage", () => {
-    const result = startOutbound({ channel: "voice", destination: "badphone" });
+  test("voice: returns invalid_destination for garbage", async () => {
+    const result = await startOutbound({
+      channel: "voice",
+      destination: "badphone",
+    });
     expect(result.success).toBe(false);
     expect(result.error).toBe("invalid_destination");
   });
 
-  test("voice: succeeds with valid phone", () => {
-    const result = startOutbound({
+  test("voice: succeeds with valid phone", async () => {
+    const result = await startOutbound({
       channel: "voice",
       destination: "+15559876543",
     });
@@ -303,9 +309,9 @@ describe("startOutbound", () => {
     expect(result.sendCount).toBe(1);
   });
 
-  test("voice: passes originConversationId to startGuardianVerificationCall", () => {
+  test("voice: passes originConversationId to startGuardianVerificationCall", async () => {
     voiceCallInitCalls.length = 0;
-    const result = startOutbound({
+    const result = await startOutbound({
       channel: "voice",
       destination: "+15559876543",
       originConversationId: "conv-origin-linkage-test",
@@ -316,9 +322,9 @@ describe("startOutbound", () => {
     expect(voiceCallInitCalls[0].phoneNumber).toBe("+15559876543");
   });
 
-  test("voice: succeeds without originConversationId (backward compat)", () => {
+  test("voice: succeeds without originConversationId (backward compat)", async () => {
     voiceCallInitCalls.length = 0;
-    const result = startOutbound({
+    const result = await startOutbound({
       channel: "voice",
       destination: "+15551119999",
     });
@@ -326,9 +332,9 @@ describe("startOutbound", () => {
     expect(voiceCallInitCalls.length).toBe(1);
   });
 
-  test("unsupported channel returns unsupported_channel", () => {
+  test("unsupported channel returns unsupported_channel", async () => {
     // Cast to bypass type checking for test purposes
-    const result = startOutbound({ channel: "email" as never });
+    const result = await startOutbound({ channel: "email" as never });
     expect(result.success).toBe(false);
     expect(result.error).toBe("unsupported_channel");
   });
@@ -345,9 +351,9 @@ describe("resendOutbound", () => {
     expect(result.error).toBe("no_active_session");
   });
 
-  test("SMS: succeeds when an active session exists and cooldown has passed", () => {
+  test("SMS: succeeds when an active session exists and cooldown has passed", async () => {
     // Start a session first
-    const startResult = startOutbound({
+    const startResult = await startOutbound({
       channel: "sms",
       destination: "+15551112222",
     });
@@ -369,8 +375,8 @@ describe("resendOutbound", () => {
     expect(resendResult.sendCount).toBe(2);
   });
 
-  test("SMS: preserves originConversationId on resend", () => {
-    const startResult = startOutbound({
+  test("SMS: preserves originConversationId on resend", async () => {
+    const startResult = await startOutbound({
       channel: "sms",
       destination: "+15551113333",
     });
@@ -395,7 +401,7 @@ describe("resendOutbound", () => {
 
   test("voice: preserves originConversationId on resend and passes it to call initiation", async () => {
     voiceCallInitCalls.length = 0;
-    const startResult = startOutbound({
+    const startResult = await startOutbound({
       channel: "voice",
       destination: "+15559991111",
     });
@@ -440,8 +446,8 @@ describe("cancelOutbound", () => {
     expect(result.error).toBe("no_active_session");
   });
 
-  test("succeeds when an active session exists", () => {
-    const startResult = startOutbound({
+  test("succeeds when an active session exists", async () => {
+    const startResult = await startOutbound({
       channel: "sms",
       destination: "+15553334444",
     });
@@ -582,8 +588,8 @@ describe("HTTP route: handleCancelOutbound", () => {
 // ===========================================================================
 
 describe("origin conversation linkage", () => {
-  test("startOutbound SMS echoes originConversationId in result", () => {
-    const result = startOutbound({
+  test("startOutbound SMS echoes originConversationId in result", async () => {
+    const result = await startOutbound({
       channel: "sms",
       destination: "+15551119999",
       originConversationId: "conv-origin-sms-test",
@@ -592,8 +598,8 @@ describe("origin conversation linkage", () => {
     expect(result.originConversationId).toBe("conv-origin-sms-test");
   });
 
-  test("startOutbound voice echoes originConversationId in result", () => {
-    const result = startOutbound({
+  test("startOutbound voice echoes originConversationId in result", async () => {
+    const result = await startOutbound({
       channel: "voice",
       destination: "+15552229999",
       originConversationId: "conv-origin-voice-test",
@@ -602,8 +608,8 @@ describe("origin conversation linkage", () => {
     expect(result.originConversationId).toBe("conv-origin-voice-test");
   });
 
-  test("startOutbound Telegram (chat ID) echoes originConversationId in result", () => {
-    const result = startOutbound({
+  test("startOutbound Telegram (chat ID) echoes originConversationId in result", async () => {
+    const result = await startOutbound({
       channel: "telegram",
       destination: "999888777",
       originConversationId: "conv-origin-tg-test",
@@ -612,8 +618,8 @@ describe("origin conversation linkage", () => {
     expect(result.originConversationId).toBe("conv-origin-tg-test");
   });
 
-  test("startOutbound without originConversationId returns undefined for field", () => {
-    const result = startOutbound({
+  test("startOutbound without originConversationId returns undefined for field", async () => {
+    const result = await startOutbound({
       channel: "sms",
       destination: "+15553338888",
     });
@@ -635,7 +641,7 @@ describe("origin conversation linkage", () => {
   });
 
   test("voice call initiation receives originConversationId", async () => {
-    const result = startOutbound({
+    const result = await startOutbound({
       channel: "voice",
       destination: "+15554443333",
       originConversationId: "conv-origin-voice-init",
@@ -656,7 +662,7 @@ describe("origin conversation linkage", () => {
     voiceCallInitCalls.length = 0;
 
     // Start a voice session (no origin initially)
-    const startResult = startOutbound({
+    const startResult = await startOutbound({
       channel: "voice",
       destination: "+15552228888",
     });

package/src/__tests__/handle-user-message-secret-resume.test.ts

@@ -40,10 +40,33 @@ mock.module("../config/loader.js", () => {
     applyNestedDefaults: (c: unknown) => c,
     getNestedValue: () => undefined,
     setNestedValue: () => {},
+    syncConfigToLockfile: () => {},
     API_KEY_PROVIDERS: [],
   };
 });
 
+const noopLogger = {
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  debug: () => {},
+  trace: () => {},
+  fatal: () => {},
+  child: () => noopLogger,
+};
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realLogger = require("../util/logger.js");
+mock.module("../util/logger.js", () => ({
+  ...realLogger,
+  getLogger: () => noopLogger,
+  getCliLogger: () => noopLogger,
+  isDebug: () => false,
+  truncateForLog: (v: string) => v,
+  initLogger: () => {},
+  pruneOldLogFiles: () => 0,
+}));
+
 const { handleUserMessage } = await import("../daemon/handlers/sessions.js");
 
 describe("handleUserMessage secret redirect continuation", () => {

package/src/__tests__/handlers-add-trust-rule-metadata.test.ts

@@ -6,41 +6,50 @@ import { beforeEach, describe, expect, test } from "bun:test";
 import { mock } from "bun:test";
 
 const testDir = mkdtempSync(join(tmpdir(), "trust-rule-metadata-test-"));
+const resolveTestDir = () => process.env.BASE_DATA_DIR ?? testDir;
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realPlatform = require("../util/platform.js");
 mock.module("../util/platform.js", () => ({
-  getRootDir: () => testDir,
-  getDataDir: () => join(testDir, "data"),
-  getWorkspaceSkillsDir: () => join(testDir, "skills"),
+  ...realPlatform,
+  getRootDir: () => resolveTestDir(),
+  getDataDir: () => join(resolveTestDir(), "data"),
+  getWorkspaceSkillsDir: () => join(resolveTestDir(), "skills"),
   isMacOS: () => process.platform === "darwin",
   isLinux: () => process.platform === "linux",
   isWindows: () => process.platform === "win32",
-  getSocketPath: () => join(testDir, "test.sock"),
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
+  getSocketPath: () => join(resolveTestDir(), "test.sock"),
+  getPidPath: () => join(resolveTestDir(), "test.pid"),
+  getDbPath: () => join(resolveTestDir(), "test.db"),
+  getLogPath: () => join(resolveTestDir(), "test.log"),
   ensureDataDir: () => {},
-  getIpcBlobDir: () => join(testDir, "ipc-blobs"),
+  getIpcBlobDir: () => join(resolveTestDir(), "ipc-blobs"),
 }));
 
+const noopLogger = {
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  debug: () => {},
+  trace: () => {},
+  fatal: () => {},
+  child: () => noopLogger,
+};
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realLogger = require("../util/logger.js");
 mock.module("../util/logger.js", () => ({
-  getLogger: () => ({
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-    debug: () => {},
-    trace: () => {},
-    fatal: () => {},
-    child: () => ({
-      info: () => {},
-      warn: () => {},
-      error: () => {},
-      debug: () => {},
-    }),
-  }),
+  ...realLogger,
+  getLogger: () => noopLogger,
+  getCliLogger: () => noopLogger,
+  isDebug: () => false,
+  truncateForLog: (value: string) => value,
+  initLogger: () => {},
+  pruneOldLogFiles: () => 0,
 }));
 
 const testConfig: Record<string, any> = {
-  permissions: { mode: "legacy" as "legacy" | "strict" | "workspace" },
+  permissions: { mode: "workspace" as "strict" | "workspace" },
   skills: { load: { extraDirs: [] as string[] } },
   sandbox: { enabled: true },
 };

package/src/__tests__/handlers-telegram-config.test.ts

@@ -22,7 +22,10 @@ mock.module("../config/loader.js", () => ({
   invalidateConfigCache: () => {},
 }));
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realPlatform = require("../util/platform.js");
 mock.module("../util/platform.js", () => ({
+  ...realPlatform,
   getRootDir: () => testDir,
   getDataDir: () => testDir,
   getIpcBlobDir: () => join(testDir, "ipc-blobs"),
@@ -36,7 +39,10 @@ mock.module("../util/platform.js", () => ({
   ensureDataDir: () => {},
 }));
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realLogger = require("../util/logger.js");
 mock.module("../util/logger.js", () => ({
+  ...realLogger,
   getLogger: () => ({
     info: () => {},
     warn: () => {},
@@ -70,9 +76,9 @@ mock.module("../security/secure-keys.js", () => ({
   deleteSecureKey: (account: string) => {
     if (account in secureKeyStore) {
       delete secureKeyStore[account];
-      return true;
+      return "deleted";
     }
-    return false;
+    return "not-found";
   },
   listSecureKeys: () => Object.keys(secureKeyStore),
   getBackendType: () => "encrypted",

package/src/__tests__/handlers-twitter-config.test.ts

@@ -71,9 +71,9 @@ mock.module("../security/secure-keys.js", () => ({
   deleteSecureKey: (account: string) => {
     if (account in secureKeyStore) {
       delete secureKeyStore[account];
-      return true;
+      return "deleted";
     }
-    return false;
+    return "not-found";
   },
   listSecureKeys: () => Object.keys(secureKeyStore),
   getBackendType: () => "encrypted",

package/src/__tests__/handlers-user-message-approval-consumption.test.ts

@@ -1,5 +1,5 @@
 import * as net from "node:net";
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../config/env.js", () => ({ isHttpAuthDisabled: () => true }));
 
@@ -47,13 +47,102 @@ mock.module("../runtime/guardian-reply-router.js", () => ({
   routeGuardianReply: routeGuardianReplyMock,
 }));
 
+// Bun's module mocks are global within the worker, so keep this mock
+// transparent when this file is not actively exercising it.
+const realCanonicalGuardianStore =
+  await import("../memory/canonical-guardian-store.js");
+(
+  globalThis as Record<string, unknown>
+).__approvalConsumptionUseMockCanonicalStore = false;
+
 mock.module("../memory/canonical-guardian-store.js", () => ({
-  createCanonicalGuardianRequest: createCanonicalGuardianRequestMock,
-  generateCanonicalRequestCode: generateCanonicalRequestCodeMock,
-  listPendingCanonicalGuardianRequestsByDestinationConversation:
-    listPendingByDestinationMock,
-  listCanonicalGuardianRequests: listCanonicalMock,
-  resolveCanonicalGuardianRequest: resolveCanonicalGuardianRequestMock,
+  createCanonicalGuardianRequest: (
+    ...args: Parameters<
+      typeof realCanonicalGuardianStore.createCanonicalGuardianRequest
+    >
+  ) =>
+    (globalThis as Record<string, unknown>)
+      .__approvalConsumptionUseMockCanonicalStore
+      ? (
+          createCanonicalGuardianRequestMock as unknown as (
+            ...mockArgs: Parameters<
+              typeof realCanonicalGuardianStore.createCanonicalGuardianRequest
+            >
+          ) => ReturnType<
+            typeof realCanonicalGuardianStore.createCanonicalGuardianRequest
+          >
+        )(...args)
+      : realCanonicalGuardianStore.createCanonicalGuardianRequest(...args),
+  generateCanonicalRequestCode: (
+    ...args: Parameters<
+      typeof realCanonicalGuardianStore.generateCanonicalRequestCode
+    >
+  ) =>
+    (globalThis as Record<string, unknown>)
+      .__approvalConsumptionUseMockCanonicalStore
+      ? (
+          generateCanonicalRequestCodeMock as unknown as (
+            ...mockArgs: Parameters<
+              typeof realCanonicalGuardianStore.generateCanonicalRequestCode
+            >
+          ) => ReturnType<
+            typeof realCanonicalGuardianStore.generateCanonicalRequestCode
+          >
+        )(...args)
+      : realCanonicalGuardianStore.generateCanonicalRequestCode(...args),
+  listPendingCanonicalGuardianRequestsByDestinationConversation: (
+    ...args: Parameters<
+      typeof realCanonicalGuardianStore.listPendingCanonicalGuardianRequestsByDestinationConversation
+    >
+  ) =>
+    (globalThis as Record<string, unknown>)
+      .__approvalConsumptionUseMockCanonicalStore
+      ? (
+          listPendingByDestinationMock as unknown as (
+            ...mockArgs: Parameters<
+              typeof realCanonicalGuardianStore.listPendingCanonicalGuardianRequestsByDestinationConversation
+            >
+          ) => ReturnType<
+            typeof realCanonicalGuardianStore.listPendingCanonicalGuardianRequestsByDestinationConversation
+          >
+        )(...args)
+      : realCanonicalGuardianStore.listPendingCanonicalGuardianRequestsByDestinationConversation(
+          ...args,
+        ),
+  listCanonicalGuardianRequests: (
+    ...args: Parameters<
+      typeof realCanonicalGuardianStore.listCanonicalGuardianRequests
+    >
+  ) =>
+    (globalThis as Record<string, unknown>)
+      .__approvalConsumptionUseMockCanonicalStore
+      ? (
+          listCanonicalMock as unknown as (
+            ...mockArgs: Parameters<
+              typeof realCanonicalGuardianStore.listCanonicalGuardianRequests
+            >
+          ) => ReturnType<
+            typeof realCanonicalGuardianStore.listCanonicalGuardianRequests
+          >
+        )(...args)
+      : realCanonicalGuardianStore.listCanonicalGuardianRequests(...args),
+  resolveCanonicalGuardianRequest: (
+    ...args: Parameters<
+      typeof realCanonicalGuardianStore.resolveCanonicalGuardianRequest
+    >
+  ) =>
+    (globalThis as Record<string, unknown>)
+      .__approvalConsumptionUseMockCanonicalStore
+      ? (
+          resolveCanonicalGuardianRequestMock as unknown as (
+            ...mockArgs: Parameters<
+              typeof realCanonicalGuardianStore.resolveCanonicalGuardianRequest
+            >
+          ) => ReturnType<
+            typeof realCanonicalGuardianStore.resolveCanonicalGuardianRequest
+          >
+        )(...args)
+      : realCanonicalGuardianStore.resolveCanonicalGuardianRequest(...args),
 }));
 
 mock.module("../runtime/pending-interactions.js", () => ({
@@ -98,7 +187,10 @@ mock.module("../runtime/local-actor-identity.js", () => ({
   }),
 }));
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realLogger = require("../util/logger.js");
 mock.module("../util/logger.js", () => ({
+  ...realLogger,
   getLogger: () => ({
     info: () => {},
     warn: () => {},
@@ -214,6 +306,9 @@ function makeSession(overrides: Partial<TestSession> = {}): TestSession {
 
 describe("handleUserMessage pending-confirmation reply interception", () => {
   beforeEach(() => {
+    (
+      globalThis as Record<string, unknown>
+    ).__approvalConsumptionUseMockCanonicalStore = true;
     routeGuardianReplyMock.mockClear();
     createCanonicalGuardianRequestMock.mockClear();
     generateCanonicalRequestCodeMock.mockClear();
@@ -227,6 +322,12 @@ describe("handleUserMessage pending-confirmation reply interception", () => {
     getConfigMock.mockClear();
   });
 
+  afterAll(() => {
+    (
+      globalThis as Record<string, unknown>
+    ).__approvalConsumptionUseMockCanonicalStore = false;
+  });
+
   test("consumes decision replies before auto-deny", async () => {
     listPendingByDestinationMock.mockReturnValue([
       { id: "req-1", kind: "tool_approval" },

package/src/__tests__/ingress-reconcile.test.ts

@@ -24,7 +24,10 @@ mock.module("../config/loader.js", () => ({
   invalidateConfigCache: () => {},
 }));
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realPlatform = require("../util/platform.js");
 mock.module("../util/platform.js", () => ({
+  ...realPlatform,
   getRootDir: () => testDir,
   getDataDir: () => testDir,
   getIpcBlobDir: () => join(testDir, "ipc-blobs"),
@@ -38,7 +41,10 @@ mock.module("../util/platform.js", () => ({
   ensureDataDir: () => {},
 }));
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realLogger = require("../util/logger.js");
 mock.module("../util/logger.js", () => ({
+  ...realLogger,
   getLogger: () => ({
     info: () => {},
     warn: () => {},

package/src/__tests__/intent-routing.test.ts

@@ -6,7 +6,10 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 // ── Mock platform to isolate tests from the real workspace ────────────
 const TEST_DIR = join(tmpdir(), `vellum-routing-test-${crypto.randomUUID()}`);
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realPlatform = require("../util/platform.js");
 mock.module("../util/platform.js", () => ({
+  ...realPlatform,
   getRootDir: () => TEST_DIR,
   getDataDir: () => TEST_DIR,
   getWorkspaceDir: () => TEST_DIR,
@@ -30,19 +33,27 @@ mock.module("../util/platform.js", () => ({
   isWindows: () => process.platform === "win32",
   getPlatformName: () => process.platform,
   getClipboardCommand: () => null,
+  readSessionToken: () => null,
   removeSocketFile: () => {},
   migratePath: () => {},
   migrateToWorkspaceLayout: () => {},
   migrateToDataLayout: () => {},
 }));
 
+const noopLogger = new Proxy({} as Record<string, unknown>, {
+  get: (_target, prop) => (prop === "child" ? () => noopLogger : () => {}),
+});
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realLogger = require("../util/logger.js");
 mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
+  ...realLogger,
+  getLogger: () => noopLogger,
+  getCliLogger: () => noopLogger,
   isDebug: () => false,
   truncateForLog: (v: string) => v,
+  initLogger: () => {},
+  pruneOldLogFiles: () => 0,
 }));
 
 mock.module("../config/loader.js", () => ({
@@ -54,6 +65,14 @@ mock.module("../config/loader.js", () => ({
       "feature_flags.guardian-verify-setup.enabled": true,
     },
   }),
+  loadConfig: () => ({}),
+  loadRawConfig: () => ({}),
+  saveConfig: () => {},
+  saveRawConfig: () => {},
+  invalidateConfigCache: () => {},
+  getNestedValue: () => undefined,
+  setNestedValue: () => {},
+  syncConfigToLockfile: () => {},
 }));
 
 // ── Import after mocks ───────────────────────────────────────────────

package/src/__tests__/invite-routes-http.test.ts

@@ -24,6 +24,18 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
+// Prevent ensureTelegramBotUsernameResolved() from reading real credentials
+// and calling the Telegram API, which would populate credential metadata
+// with the real bot username and shadow the env var override in tests.
+mock.module("../security/secure-keys.js", () => ({
+  getSecureKey: () => undefined,
+  setSecureKey: () => {},
+  deleteSecureKey: () => {},
+  getSecureKeyAsync: async () => undefined,
+  setSecureKeyAsync: async () => {},
+  deleteSecureKeyAsync: async () => {},
+}));
+
 import { getSqlite, initializeDb, resetDb } from "../memory/db.js";
 import {
   handleCreateInvite,