@vellumai/assistant 0.4.43 → 0.4.45

package/src/__tests__/assistant-events-sse-hardening.test.ts

@@ -21,7 +21,6 @@ mock.module("../util/platform.js", () => ({
   isMacOS: () => process.platform === "darwin",
   isLinux: () => process.platform === "linux",
   isWindows: () => process.platform === "win32",
-  getSocketPath: () => join(testDir, "test.sock"),
   getPidPath: () => join(testDir, "test.pid"),
   getDbPath: () => join(testDir, "test.db"),
   getLogPath: () => join(testDir, "test.log"),

package/src/__tests__/assistant-feature-flag-guardrails.test.ts

@@ -56,8 +56,6 @@ function loadRegistry(): Registry {
  * exercising legacy paths.
  */
 const LEGACY_KEY_ALLOWLIST = new Set([
-  // Legacy wrapper (deprecated, kept for migration)
-  "assistant/src/config/skill-state.ts",
   // Type definitions documenting the legacy format
   "assistant/src/config/types.ts",
   // macOS client: fallback reads from legacy config section

package/src/__tests__/assistant-feature-flags-integration.test.ts

@@ -32,7 +32,8 @@ let currentConfig: Record<string, unknown> = {
   sandbox: { enabled: false, backend: "native" },
 };
 
-const DECLARED_FLAG_KEY = "feature_flags.hatch-new-assistant.enabled";
+const DECLARED_FLAG_ID = "hatch-new-assistant";
+const DECLARED_FLAG_KEY = `feature_flags.${DECLARED_FLAG_ID}.enabled`;
 const DECLARED_SKILL_ID = "hatch-new-assistant";
 
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -47,7 +48,6 @@ mock.module("../util/platform.js", () => ({
   getWorkspaceHooksDir: () => join(TEST_DIR, "hooks"),
   getWorkspacePromptPath: (file: string) => join(TEST_DIR, file),
   ensureDataDir: () => {},
-  getSocketPath: () => join(TEST_DIR, "vellum.sock"),
   getPidPath: () => join(TEST_DIR, "vellum.pid"),
   getDbPath: () => join(TEST_DIR, "data", "assistant.db"),
   getLogPath: () => join(TEST_DIR, "logs", "vellum.log"),
@@ -138,12 +138,16 @@ function createSkillOnDisk(
   id: string,
   name: string,
   description: string,
+  featureFlag?: string,
 ): void {
   const skillsDir = join(TEST_DIR, "skills");
   mkdirSync(join(skillsDir, id), { recursive: true });
+  const ffBlock = featureFlag
+    ? `\nmetadata: {"vellum":{"feature-flag":"${featureFlag}"}}`
+    : "";
   writeFileSync(
     join(skillsDir, id, "SKILL.md"),
-    `---\nname: "${name}"\ndescription: "${description}"\n---\n\nInstructions for ${id}.\n`,
+    `---\nname: "${name}"\ndescription: "${description}"${ffBlock}\n---\n\nInstructions for ${id}.\n`,
   );
   const indexPath = join(skillsDir, "SKILLS.md");
   const existing = existsSync(indexPath)
@@ -162,21 +166,27 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       DECLARED_SKILL_ID,
       "Hatch New Assistant",
       "Toggle hatch new assistant behavior",
+      DECLARED_FLAG_ID,
+    );
+    createSkillOnDisk(
+      "browser",
+      "Browser",
+      "Web browsing automation",
+      "browser",
     );
-    createSkillOnDisk("twitter", "Twitter", "Post to X/Twitter");
 
     currentConfig = {
       sandbox: { enabled: false, backend: "native" },
       assistantFeatureFlagValues: {
         [DECLARED_FLAG_KEY]: false,
-        "feature_flags.twitter.enabled": true,
+        "feature_flags.browser.enabled": true,
       },
     };
 
     const result = buildSystemPrompt();
 
-    // twitter is explicitly enabled, declared flagged skill is explicitly off
-    expect(result).toContain('id="twitter"');
+    // browser is explicitly enabled, declared flagged skill is explicitly off
+    expect(result).toContain('id="browser"');
     expect(result).not.toContain(`id="${DECLARED_SKILL_ID}"`);
   });
 
@@ -185,8 +195,14 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       DECLARED_SKILL_ID,
       "Hatch New Assistant",
       "Toggle hatch new assistant behavior",
+      DECLARED_FLAG_ID,
+    );
+    createSkillOnDisk(
+      "contacts",
+      "Contacts",
+      "View and manage contacts",
+      "contacts",
     );
-    createSkillOnDisk("twitter", "Twitter", "Post to X/Twitter");
 
     currentConfig = {
       sandbox: { enabled: false, backend: "native" },
@@ -194,9 +210,9 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
 
     const result = buildSystemPrompt();
 
-    // Both skills are declared in the registry with defaultEnabled: false
+    // Both skills declare feature flags with registry defaultEnabled: false
     expect(result).not.toContain(`id="${DECLARED_SKILL_ID}"`);
-    expect(result).not.toContain('id="twitter"');
+    expect(result).not.toContain('id="contacts"');
   });
 
   test("flagged-off skills hidden when all flags are OFF", () => {
@@ -204,21 +220,27 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       DECLARED_SKILL_ID,
       "Hatch New Assistant",
       "Toggle hatch new assistant behavior",
+      DECLARED_FLAG_ID,
+    );
+    createSkillOnDisk(
+      "contacts",
+      "Contacts",
+      "View and manage contacts",
+      "contacts",
     );
-    createSkillOnDisk("twitter", "Twitter", "Post to X/Twitter");
 
     currentConfig = {
       sandbox: { enabled: false, backend: "native" },
       assistantFeatureFlagValues: {
         [DECLARED_FLAG_KEY]: false,
-        "feature_flags.twitter.enabled": false,
+        "feature_flags.contacts.enabled": false,
       },
     };
 
     const result = buildSystemPrompt();
 
     expect(result).not.toContain(`id="${DECLARED_SKILL_ID}"`);
-    expect(result).not.toContain('id="twitter"');
+    expect(result).not.toContain('id="contacts"');
   });
 
   test("assistantFeatureFlagValues overrides control visibility", () => {
@@ -226,6 +248,7 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       DECLARED_SKILL_ID,
       "Hatch New Assistant",
       "Toggle hatch new assistant behavior",
+      DECLARED_FLAG_ID,
     );
 
     currentConfig = {
@@ -239,7 +262,12 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
   });
 
   test("persisted overrides for undeclared flags are respected", () => {
-    createSkillOnDisk("browser", "Browser", "Web browsing automation");
+    createSkillOnDisk(
+      "browser",
+      "Browser",
+      "Web browsing automation",
+      "browser",
+    );
 
     currentConfig = {
       sandbox: { enabled: false, backend: "native" },
@@ -248,13 +276,18 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
 
     const result = buildSystemPrompt();
 
-    // Even though 'browser' is not in the defaults registry, the user
+    // browser declares featureFlag: "browser" and the user
     // explicitly disabled it — that override must be honored.
     expect(result).not.toContain('id="browser"');
   });
 
   test("declared flags with no persisted override use registry default", () => {
-    createSkillOnDisk("browser", "Browser", "Web browsing automation");
+    createSkillOnDisk(
+      "browser",
+      "Browser",
+      "Web browsing automation",
+      "browser",
+    );
 
     currentConfig = {
       sandbox: { enabled: false, backend: "native" },
@@ -265,6 +298,19 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
     // browser is declared in the registry with defaultEnabled: true
     expect(result).toContain('id="browser"');
   });
+
+  test("skill without featureFlag is never flag-gated", () => {
+    createSkillOnDisk("my-skill", "My Skill", "A skill without feature flag");
+
+    currentConfig = {
+      sandbox: { enabled: false, backend: "native" },
+    };
+
+    const result = buildSystemPrompt();
+
+    // Skills without featureFlag declared are never gated — always pass through
+    expect(result).toContain('id="my-skill"');
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -329,7 +375,10 @@ describe("isAssistantFeatureFlagEnabled with skillFlagKey", () => {
     } as any;
 
     expect(
-      isAssistantFeatureFlagEnabled(skillFlagKey(DECLARED_SKILL_ID), config),
+      isAssistantFeatureFlagEnabled(
+        skillFlagKey({ featureFlag: DECLARED_FLAG_ID })!,
+        config,
+      ),
     ).toBe(false);
   });
 
@@ -337,7 +386,10 @@ describe("isAssistantFeatureFlagEnabled with skillFlagKey", () => {
     const config = {} as any;
 
     expect(
-      isAssistantFeatureFlagEnabled(skillFlagKey(DECLARED_SKILL_ID), config),
+      isAssistantFeatureFlagEnabled(
+        skillFlagKey({ featureFlag: DECLARED_FLAG_ID })!,
+        config,
+      ),
     ).toBe(false);
   });
 });

package/src/__tests__/assistant-id-boundary-guard.test.ts

@@ -244,7 +244,7 @@ describe("assistant ID boundary", () => {
     // Excluded:
     //   - Test files (they may legitimately assert against the value)
     //   - Migration files (SQL literals like DEFAULT 'self' are fine)
-    //   - IPC contract files (comments documenting default values are fine)
+    //   - Message contract files (comments documenting default values are fine)
     //   - CSP headers ('self' in Content-Security-Policy has nothing to do with assistant IDs)
     const pattern = `(assistantId|assistant_id).*['"]self['"]`;
 
@@ -307,21 +307,21 @@ describe("assistant ID boundary", () => {
   // -------------------------------------------------------------------------
   // Rule (e): No assistantId on daemon control-plane request/param types
   //
-  // Daemon IPC contracts and guardian outbound param interfaces must not
+  // Daemon message contracts and guardian outbound param interfaces must not
   // accept an assistantId field -- the daemon always uses
   // DAEMON_INTERNAL_ASSISTANT_ID internally. Accepting assistantId on these
   // surfaces invites callers to pass external IDs into daemon scoping.
   // -------------------------------------------------------------------------
 
-  test("IPC contract types do not contain assistantId for guardian requests", () => {
-    const ipcContractPath = join(
+  test("message contract types do not contain assistantId for guardian requests", () => {
+    const contractPath = join(
       import.meta.dir,
       "..",
       "daemon",
       "message-types",
       "integrations.ts",
     );
-    const content = readFileSync(ipcContractPath, "utf-8");
+    const content = readFileSync(contractPath, "utf-8");
 
     // Extract the interface blocks for the request types and verify
     // none of them declare an assistantId property.
@@ -334,7 +334,7 @@ describe("assistant ID boundary", () => {
       const typeIndex = content.indexOf(typeName);
       expect(
         typeIndex,
-        `Expected to find ${typeName} in IPC contract`,
+        `Expected to find ${typeName} in message contract`,
       ).toBeGreaterThan(-1);
 
       // Extract from the type declaration to the next '}' line

package/src/__tests__/attachments-store.test.ts

@@ -10,7 +10,6 @@ mock.module("../util/platform.js", () => ({
   isMacOS: () => process.platform === "darwin",
   isLinux: () => process.platform === "linux",
   isWindows: () => process.platform === "win32",
-  getSocketPath: () => join(testDir, "test.sock"),
   getPidPath: () => join(testDir, "test.pid"),
   getDbPath: () => join(testDir, "test.db"),
   getLogPath: () => join(testDir, "test.log"),

package/src/__tests__/avatar-e2e.test.ts

@@ -4,7 +4,6 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 // Mock state — mutable variables control per-test behavior
 // ---------------------------------------------------------------------------
 
-let mockStrategy: string = "local_only";
 let mockGeminiKey: string | undefined = "test-gemini-key";
 let mockApiKey: string | undefined = "test-api-key-123";
 let mockBaseUrl = "https://platform.test.vellum.ai";
@@ -33,7 +32,6 @@ const geminiGenerateContentFn = mock(async () => geminiGenerateContentResult);
 mock.module("../config/loader.js", () => ({
   getConfig: () => ({
     apiKeys: { gemini: mockGeminiKey },
-    avatar: { generationStrategy: mockStrategy },
     platform: { baseUrl: mockBaseUrl },
     imageGenModel: "gemini-2.5-flash-image",
   }),
@@ -125,19 +123,15 @@ function executeAvatar(description: string) {
   );
 }
 
-/** Standard successful managed avatar platform response. */
+/** Standard successful Vertex predictions response. */
 function managedPlatformResponse() {
   return {
-    image: {
-      mime_type: "image/png",
-      data_base64: "iVBORw0KGgoAAAANSUhEUg==",
-      bytes: 1024,
-      sha256: "abc123",
-    },
-    usage: { billable: true, class_name: "assistant_avatar_system" },
-    generation_source: "vertex",
-    profile: "avatar_v1",
-    correlation_id: "managed-corr-id-123",
+    predictions: [
+      {
+        bytesBase64Encoded: "iVBORw0KGgoAAAANSUhEUg==",
+        mimeType: "image/png",
+      },
+    ],
   };
 }
 
@@ -171,6 +165,10 @@ function mockFetchReturning(response: {
       ok: response.ok,
       status: response.status,
       json: async () => response.body,
+      text: async () =>
+        typeof response.body === "string"
+          ? response.body
+          : JSON.stringify(response.body),
     }),
   ) as unknown as typeof globalThis.fetch;
 }
@@ -189,7 +187,6 @@ describe("avatar E2E integration", () => {
   const originalGeminiKey = process.env.GEMINI_API_KEY;
 
   beforeEach(() => {
-    mockStrategy = "local_only";
     mockGeminiKey = "test-gemini-key";
     mockApiKey = "test-api-key-123";
     mockBaseUrl = "https://platform.test.vellum.ai";
@@ -225,8 +222,7 @@ describe("avatar E2E integration", () => {
   // 1. Managed success E2E
   // -----------------------------------------------------------------------
 
-  test("managed_required success — file written, correct content, success message", async () => {
-    mockStrategy = "managed_required";
+  test("managed success — file written, correct content, success message", async () => {
     mockFetchReturning({
       ok: true,
       status: 200,
@@ -261,43 +257,10 @@ describe("avatar E2E integration", () => {
   });
 
   // -----------------------------------------------------------------------
-  // 2. Managed-required failure E2E — no fallback
-  // -----------------------------------------------------------------------
-
-  test("managed_required failure — error surfaced, no file written, no fallback", async () => {
-    mockStrategy = "managed_required";
-    mockFetchReturning({
-      ok: false,
-      status: 500,
-      body: {
-        code: "internal_error",
-        subcode: "server_fault",
-        detail: "Internal server error",
-        retryable: true,
-        correlation_id: "corr-500",
-      },
-    });
-
-    const result = await executeAvatar("a friendly robot");
-
-    // Verify error is surfaced
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain("failed");
-
-    // Verify no file was written
-    expect(writeFileSyncFn).not.toHaveBeenCalled();
-    expect(renameSyncFn).not.toHaveBeenCalled();
-
-    // Verify Gemini was never called (no fallback)
-    expect(geminiGenerateContentFn).not.toHaveBeenCalled();
-  });
-
-  // -----------------------------------------------------------------------
-  // 3. Managed-prefer fallback E2E
+  // 2. Managed failure — falls back to local
   // -----------------------------------------------------------------------
 
-  test("managed_prefer fallback — managed fails, local Gemini used, file written", async () => {
-    mockStrategy = "managed_prefer";
+  test("managed failure — falls back to local Gemini, file written", async () => {
     mockFetchReturning({
       ok: false,
       status: 502,
@@ -325,11 +288,10 @@ describe("avatar E2E integration", () => {
   });
 
   // -----------------------------------------------------------------------
-  // 4. Managed-prefer no-fallback when managed unavailable (no API key)
+  // 3. No managed prerequisites — goes straight to local
   // -----------------------------------------------------------------------
 
-  test("managed_prefer without API key — goes straight to local Gemini", async () => {
-    mockStrategy = "managed_prefer";
+  test("no managed API key — goes straight to local Gemini", async () => {
     mockApiKey = undefined; // No managed API key available
 
     const result = await executeAvatar("a cute cat");
@@ -347,81 +309,76 @@ describe("avatar E2E integration", () => {
   });
 
   // -----------------------------------------------------------------------
-  // 5. Local-only E2E
+  // 4. No managed prerequisites and no local key — error
   // -----------------------------------------------------------------------
 
-  test("local_only — only local Gemini called, managed never contacted", async () => {
-    mockStrategy = "local_only";
-    const fetchMock = mock(() =>
-      Promise.resolve({ ok: true, status: 200, json: async () => ({}) }),
-    );
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
+  test("no managed API key and no Gemini key — error surfaced", async () => {
+    mockApiKey = undefined;
+    mockGeminiKey = undefined;
 
     const result = await executeAvatar("a whimsical owl");
 
-    // Verify success
-    expect(result.isError).toBe(false);
-    expect(result.content).toContain("Avatar updated");
-
-    // Verify Gemini was called
-    expect(geminiGenerateContentFn).toHaveBeenCalledTimes(1);
-
-    // Verify managed endpoint was never contacted
-    expect(fetchMock).not.toHaveBeenCalled();
-
-    // Verify file was written
-    expect(writeFileSyncFn).toHaveBeenCalledTimes(1);
-    expect(renameSyncFn).toHaveBeenCalledTimes(1);
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("failed");
   });
 
   // -----------------------------------------------------------------------
-  // 6. Response validation — bad MIME type
+  // 5. Response validation — bad MIME type
   // -----------------------------------------------------------------------
 
-  test("managed response with disallowed MIME type — rejected, no file written", async () => {
-    mockStrategy = "managed_required";
-    const badResponse = managedPlatformResponse();
-    badResponse.image.mime_type = "image/gif";
-    mockFetchReturning({ ok: true, status: 200, body: badResponse });
+  test("managed response with disallowed MIME type — falls back to local", async () => {
+    mockFetchReturning({
+      ok: true,
+      status: 200,
+      body: {
+        predictions: [
+          {
+            bytesBase64Encoded: "iVBORw0KGgoAAAANSUhEUg==",
+            mimeType: "image/gif",
+          },
+        ],
+      },
+    });
 
     const result = await executeAvatar("a cat");
 
-    // Verify error returned
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain("failed");
-
-    // Verify no file was written
-    expect(writeFileSyncFn).not.toHaveBeenCalled();
-    expect(renameSyncFn).not.toHaveBeenCalled();
+    // Managed fails validation, falls back to local Gemini
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Avatar updated");
+    expect(geminiGenerateContentFn).toHaveBeenCalledTimes(1);
   });
 
   // -----------------------------------------------------------------------
-  // 7. Response validation — oversized image
+  // 6. Response validation — oversized image
   // -----------------------------------------------------------------------
 
-  test("managed response with oversized data — rejected, no file written", async () => {
-    mockStrategy = "managed_required";
-    const oversizedResponse = managedPlatformResponse();
-    oversizedResponse.image.bytes = AVATAR_MAX_DECODED_BYTES + 1;
-    mockFetchReturning({ ok: true, status: 200, body: oversizedResponse });
+  test("managed response with oversized data — falls back to local", async () => {
+    const oversizedBase64 = "A".repeat(
+      Math.ceil(((AVATAR_MAX_DECODED_BYTES + 100) * 4) / 3),
+    );
+    mockFetchReturning({
+      ok: true,
+      status: 200,
+      body: {
+        predictions: [
+          { bytesBase64Encoded: oversizedBase64, mimeType: "image/png" },
+        ],
+      },
+    });
 
     const result = await executeAvatar("a cat");
 
-    // Verify error returned
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain("failed");
-
-    // Verify no file was written
-    expect(writeFileSyncFn).not.toHaveBeenCalled();
-    expect(renameSyncFn).not.toHaveBeenCalled();
+    // Managed fails validation, falls back to local Gemini
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Avatar updated");
+    expect(geminiGenerateContentFn).toHaveBeenCalledTimes(1);
   });
 
   // -----------------------------------------------------------------------
-  // 8. Rate limit user message
+  // 7. Rate limit — falls back to local
   // -----------------------------------------------------------------------
 
-  test("managed 429 response — user-friendly rate limit message", async () => {
-    mockStrategy = "managed_required";
+  test("managed 429 response — falls back to local Gemini", async () => {
     mockFetchReturning({
       ok: false,
       status: 429,
@@ -436,19 +393,22 @@ describe("avatar E2E integration", () => {
 
     const result = await executeAvatar("a cat");
 
-    expect(result.isError).toBe(true);
-    expect(result.content.toLowerCase()).toContain("rate limited");
+    // Falls back to local successfully
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Avatar updated");
+    expect(geminiGenerateContentFn).toHaveBeenCalledTimes(1);
   });
 
   // -----------------------------------------------------------------------
-  // 9. Correlation ID propagation
+  // 8. Correlation ID propagation
   // -----------------------------------------------------------------------
 
-  test("managed success — correlation ID from response is propagated through the pipeline", async () => {
-    mockStrategy = "managed_required";
-    const response = managedPlatformResponse();
-    response.correlation_id = "unique-corr-id-xyz";
-    mockFetchReturning({ ok: true, status: 200, body: response });
+  test("managed success — correlation ID is propagated through the pipeline", async () => {
+    mockFetchReturning({
+      ok: true,
+      status: 200,
+      body: managedPlatformResponse(),
+    });
 
     const result = await executeAvatar("a robot");
 
@@ -456,15 +416,14 @@ describe("avatar E2E integration", () => {
     expect(result.isError).toBe(false);
     expect(writeFileSyncFn).toHaveBeenCalled();
 
+    // Correlation ID is now generated client-side, so just verify one is logged
     const correlationLogged = logInfoCalls.some(([meta, message]) => {
       if (message !== "Avatar saved successfully") return false;
       if (!meta || typeof meta !== "object" || !("correlationId" in meta)) {
         return false;
       }
-      return (
-        (meta as { correlationId?: unknown }).correlationId ===
-        "unique-corr-id-xyz"
-      );
+      const cid = (meta as { correlationId?: unknown }).correlationId;
+      return typeof cid === "string" && cid.length > 0;
     });
 
     expect(correlationLogged).toBe(true);