@vellumai/assistant 0.4.43 → 0.4.45

package/src/__tests__/avatar-router.test.ts

@@ -4,7 +4,6 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 // Mock state
 // ---------------------------------------------------------------------------
 
-let mockStrategy: string | undefined;
 let mockGeminiKey: string | undefined = "test-gemini-key";
 let mockManagedAvailable = true;
 let mockManagedResult: unknown;
@@ -27,7 +26,6 @@ const isManagedAvailableFn = mock(() => mockManagedAvailable);
 mock.module("../config/loader.js", () => ({
   getConfig: () => ({
     apiKeys: { gemini: mockGeminiKey },
-    avatar: { generationStrategy: mockStrategy ?? "local_only" },
   }),
 }));
 
@@ -50,10 +48,7 @@ mock.module("../media/gemini-image-service.js", () => ({
 }));
 
 // Import after mocking
-import {
-  getAvatarStrategy,
-  routedGenerateAvatar,
-} from "../media/avatar-router.js";
+import { routedGenerateAvatar } from "../media/avatar-router.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -67,9 +62,6 @@ function managedResponse() {
       bytes: 1024,
       sha256: "abc",
     },
-    usage: { billable: false, class_name: "assistant_avatar_system" },
-    generation_source: "vertex",
-    profile: "avatar_v1",
     correlation_id: "test-correlation-id",
   };
 }
@@ -87,7 +79,6 @@ function geminiResponse() {
 
 describe("avatar-router", () => {
   beforeEach(() => {
-    mockStrategy = undefined;
     mockGeminiKey = "test-gemini-key";
     mockManagedAvailable = true;
     mockManagedResult = managedResponse();
@@ -98,9 +89,7 @@ describe("avatar-router", () => {
     isManagedAvailableFn.mockClear();
   });
 
-  // 1. managed_required — managed success
-  test("managed_required returns pathUsed managed on success", async () => {
-    mockStrategy = "managed_required";
+  test("uses managed path when available", async () => {
     const result = await routedGenerateAvatar("a cute cat");
     expect(result.pathUsed).toBe("managed");
     expect(result.imageBase64).toBe("base64data");
@@ -109,31 +98,25 @@ describe("avatar-router", () => {
     expect(generateImageFn).not.toHaveBeenCalled();
   });
 
-  // 2. managed_required — managed failure throws, no fallback
-  test("managed_required throws on managed failure without fallback", async () => {
-    mockStrategy = "managed_required";
-    mockManagedError = new Error("upstream error");
-    await expect(routedGenerateAvatar("a cute cat")).rejects.toThrow(
-      "upstream error",
-    );
-    expect(generateImageFn).not.toHaveBeenCalled();
+  test("falls back to local when managed fails", async () => {
+    mockManagedError = new Error("managed failed");
+    const result = await routedGenerateAvatar("a cute cat");
+    expect(result.pathUsed).toBe("local");
+    expect(generateManagedAvatarFn).toHaveBeenCalledTimes(1);
+    expect(generateImageFn).toHaveBeenCalledTimes(1);
   });
 
-  // 3. local_only — calls local Gemini, never managed
-  test("local_only calls local Gemini and never managed", async () => {
-    mockStrategy = "local_only";
+  test("goes to local when managed unavailable", async () => {
+    mockManagedAvailable = false;
     const result = await routedGenerateAvatar("a cute cat");
     expect(result.pathUsed).toBe("local");
-    expect(result.imageBase64).toBe("base64data");
-    expect(generateImageFn).toHaveBeenCalledTimes(1);
     expect(generateManagedAvatarFn).not.toHaveBeenCalled();
+    expect(generateImageFn).toHaveBeenCalledTimes(1);
   });
 
-  // 4. local_only — missing Gemini API key throws
-  test("local_only throws when Gemini API key is missing", async () => {
-    mockStrategy = "local_only";
+  test("throws when managed unavailable and no Gemini key", async () => {
+    mockManagedAvailable = false;
     mockGeminiKey = undefined;
-    // Also clear the env var to ensure no fallback
     const saved = process.env.GEMINI_API_KEY;
     delete process.env.GEMINI_API_KEY;
     try {
@@ -146,41 +129,21 @@ describe("avatar-router", () => {
     }
   });
 
-  // 5. managed_prefer — managed success
-  test("managed_prefer returns pathUsed managed on success", async () => {
-    mockStrategy = "managed_prefer";
-    const result = await routedGenerateAvatar("a cute cat");
-    expect(result.pathUsed).toBe("managed");
+  test("forwards model to generateManagedAvatar", async () => {
+    const result = await routedGenerateAvatar("a cute cat", {
+      model: "imagen-3.0-generate-002",
+    });
     expect(generateManagedAvatarFn).toHaveBeenCalledTimes(1);
-    expect(generateImageFn).not.toHaveBeenCalled();
-  });
-
-  // 6. managed_prefer — managed failure falls back to local
-  test("managed_prefer falls back to local on managed failure", async () => {
-    mockStrategy = "managed_prefer";
-    mockManagedError = new Error("managed failed");
-    const result = await routedGenerateAvatar("a cute cat");
-    expect(result.pathUsed).toBe("local");
-    expect(generateManagedAvatarFn).toHaveBeenCalledTimes(1);
-    expect(generateImageFn).toHaveBeenCalledTimes(1);
+    expect(generateManagedAvatarFn).toHaveBeenCalledWith("a cute cat", {
+      correlationId: undefined,
+      model: "imagen-3.0-generate-002",
+    });
+    expect(result.model).toBe("imagen-3.0-generate-002");
+    expect(result.pathUsed).toBe("managed");
   });
 
-  // 7. managed_prefer — managed unavailable goes directly to local
-  test("managed_prefer goes to local when managed unavailable", async () => {
-    mockStrategy = "managed_prefer";
-    mockManagedAvailable = false;
+  test("model is undefined in result when not provided", async () => {
     const result = await routedGenerateAvatar("a cute cat");
-    expect(result.pathUsed).toBe("local");
-    expect(generateManagedAvatarFn).not.toHaveBeenCalled();
-    expect(generateImageFn).toHaveBeenCalledTimes(1);
+    expect(result.model).toBeUndefined();
   });
-
-  // 8. Default strategy is local_only when config key absent
-  test("defaults to local_only when config key is absent", () => {
-    mockStrategy = undefined;
-    expect(getAvatarStrategy()).toBe("local_only");
-  });
-
-  // 9. Removed: Invalid strategy values are now rejected at config parse time
-  // by the Zod schema, so they cannot reach getAvatarStrategy().
 });

package/src/__tests__/browser-manager.test.ts

@@ -15,6 +15,7 @@ mock.module("../util/logger.js", () => ({
 
 import {
   browserManager,
+  sanitizeDownloadFilename,
   setLaunchFn,
 } from "../tools/browser/browser-manager.js";
 
@@ -73,6 +74,29 @@ function createMockContext() {
   };
 }
 
+describe("sanitizeDownloadFilename", () => {
+  test("keeps a normal filename", () => {
+    expect(sanitizeDownloadFilename("report.json")).toBe("report.json");
+  });
+
+  test("removes traversal segments and separators", () => {
+    expect(sanitizeDownloadFilename("../../.ssh/authorized_keys")).toBe(
+      "authorized_keys",
+    );
+    expect(
+      sanitizeDownloadFilename(
+        "..\\..\\windows\\system32\\drivers\\etc\\hosts",
+      ),
+    ).toBe("hosts");
+  });
+
+  test("falls back to safe default for empty or dot paths", () => {
+    expect(sanitizeDownloadFilename("   ")).toBe("download");
+    expect(sanitizeDownloadFilename(".")).toBe("download");
+    expect(sanitizeDownloadFilename("..")).toBe("download");
+  });
+});
+
 describe("BrowserManager", () => {
   let mockCtx: ReturnType<typeof createMockContext>;
 

package/src/__tests__/browser-skill-baseline-tool-payload.test.ts

@@ -43,10 +43,11 @@ describe("browser skill cutover — startup tool payload", () => {
 
   test("total tool definition count reflects removal of 14 browser tools", () => {
     const definitions = getAllToolDefinitions();
-    // Startup has ~31 definitions (no browser tools).
+    // Startup has ~20 definitions after moving scaffold/settings/skill-management
+    // tools to bundled skills (no browser tools).
     // Allow wider drift for unrelated tool additions while still failing if
-    // browser tools are reintroduced at startup (+10 definitions).
-    expect(definitions.length).toBeGreaterThanOrEqual(25);
+    // browser tools are reintroduced at startup (+14 definitions).
+    expect(definitions.length).toBeGreaterThanOrEqual(15);
     expect(definitions.length).toBeLessThanOrEqual(50);
   });
 

package/src/__tests__/browser-skill-endstate.test.ts

@@ -78,10 +78,11 @@ describe("browser skill migration end-state", () => {
 
   test("startup tool definition count is reduced (no browser tools)", () => {
     const definitions = getAllToolDefinitions();
-    // Startup has ~15 eager + ~11 explicit definitions (no browser tools).
+    // Startup has ~20 definitions after moving scaffold/settings/skill-management
+    // tools to bundled skills (no browser tools).
     // Allow wider drift for unrelated tool additions while still failing if
     // browser tools are reintroduced at startup (+14 definitions).
-    expect(definitions.length).toBeGreaterThanOrEqual(10);
+    expect(definitions.length).toBeGreaterThanOrEqual(15);
     expect(definitions.length).toBeLessThanOrEqual(50);
 
     const defNames = definitions.map((d) => d.name);
@@ -222,16 +223,12 @@ describe("browser skill migration end-state", () => {
         previouslyActiveSkillIds: tracking,
       });
 
-      // Exactly 14 new tool definitions should be projected
-      expect(projection.toolDefinitions).toHaveLength(BROWSER_TOOL_COUNT);
+      // Tool definitions are no longer sent to the LLM (dispatched via
+      // skill_execute), so toolDefinitions is expected to be empty.
+      expect(projection.toolDefinitions).toHaveLength(0);
 
-      // Every browser tool name should be in the projection
-      const projectedNames = projection.toolDefinitions.map((d) => d.name);
-      for (const name of BROWSER_TOOL_NAMES) {
-        expect(projectedNames).toContain(name);
-      }
-
-      // The allowedToolNames set should also contain all browser tools
+      // All 14 browser tools should be registered and tracked in allowedToolNames
+      expect(projection.allowedToolNames.size).toBe(BROWSER_TOOL_COUNT);
       for (const name of BROWSER_TOOL_NAMES) {
         expect(projection.allowedToolNames.has(name)).toBe(true);
       }

package/src/__tests__/btw-routes.test.ts

@@ -0,0 +1,326 @@
+/**
+ * Unit tests for the POST /v1/btw SSE-streaming side-chain endpoint.
+ *
+ * Validates request validation (400s), service unavailability (503),
+ * successful SSE streaming, provider argument passing, no persistence,
+ * and no session.processing mutation.
+ */
+
+import { describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Mocks — must be defined before importing the module under test
+// ---------------------------------------------------------------------------
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+const mockGetOrCreateConversation = mock((_key: string) => ({
+  conversationId: "conv-test-123",
+  created: false,
+}));
+
+mock.module("../memory/conversation-key-store.js", () => ({
+  getOrCreateConversation: mockGetOrCreateConversation,
+}));
+
+const mockAddMessage = mock(() => {});
+
+mock.module("../memory/conversation-crud.js", () => ({
+  addMessage: mockAddMessage,
+}));
+
+const MOCK_TOOLS = [
+  {
+    name: "test_tool",
+    description: "A test tool",
+    input_schema: { type: "object", properties: {} },
+  },
+];
+
+mock.module("../daemon/session-tool-setup.js", () => ({
+  buildToolDefinitions: () => MOCK_TOOLS,
+}));
+
+// ---------------------------------------------------------------------------
+// Imports (after mocks)
+// ---------------------------------------------------------------------------
+
+import type {
+  ProviderResponse,
+  SendMessageOptions,
+} from "../providers/types.js";
+import type { AuthContext, Scope } from "../runtime/auth/types.js";
+import type { SendMessageDeps } from "../runtime/http-types.js";
+import { btwRouteDefinitions } from "../runtime/routes/btw-routes.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const FAKE_AUTH_CONTEXT: AuthContext = {
+  subject: "test-user",
+  principalType: "local",
+  assistantId: "self",
+  scopeProfile: "local_v1",
+  scopes: new Set<Scope>(["local.all"]),
+  policyEpoch: 0,
+};
+
+function makeMockProvider(
+  onSendMessage?: (
+    messages: unknown[],
+    tools: unknown[],
+    systemPrompt: string | undefined,
+    options: SendMessageOptions | undefined,
+  ) => Promise<ProviderResponse>,
+) {
+  const defaultSendMessage = async (
+    _messages: unknown[],
+    _tools: unknown[],
+    _systemPrompt: string | undefined,
+    options: SendMessageOptions | undefined,
+  ): Promise<ProviderResponse> => {
+    options?.onEvent?.({ type: "text_delta", text: "hello" });
+    return {
+      content: [{ type: "text", text: "hello" }],
+      model: "test-model",
+      usage: { inputTokens: 10, outputTokens: 5 },
+      stopReason: "end_turn",
+    };
+  };
+
+  return {
+    name: "test-provider",
+    sendMessage: mock(onSendMessage ?? defaultSendMessage),
+  };
+}
+
+function makeMockSession(
+  providerOverride?: ReturnType<typeof makeMockProvider>,
+) {
+  const provider = providerOverride ?? makeMockProvider();
+  return {
+    provider,
+    systemPrompt: "You are a helpful assistant.",
+    processing: false,
+    getMessages: () => [
+      {
+        role: "user" as const,
+        content: [{ type: "text" as const, text: "prior message" }],
+      },
+      {
+        role: "assistant" as const,
+        content: [{ type: "text" as const, text: "prior response" }],
+      },
+    ],
+  };
+}
+
+function makeSendMessageDeps(
+  session?: ReturnType<typeof makeMockSession>,
+): SendMessageDeps {
+  const s = session ?? makeMockSession();
+  return {
+    getOrCreateSession: mock(
+      async (_conversationId: string) => s,
+    ) as unknown as SendMessageDeps["getOrCreateSession"],
+    assistantEventHub: {} as never,
+    resolveAttachments: () => [],
+  };
+}
+
+function makeRequest(body: Record<string, unknown>): Request {
+  return new Request("http://localhost/v1/btw", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+async function callHandler(
+  body: Record<string, unknown>,
+  deps: { sendMessageDeps?: SendMessageDeps },
+): Promise<Response> {
+  const routes = btwRouteDefinitions(deps);
+  const route = routes.find((r) => r.endpoint === "btw" && r.method === "POST");
+  if (!route) throw new Error("btw route not found");
+  const req = makeRequest(body);
+  const url = new URL(req.url);
+  return route.handler({
+    req,
+    url,
+    server: null as never,
+    authContext: FAKE_AUTH_CONTEXT,
+    params: {},
+  });
+}
+
+async function readStream(response: Response): Promise<string> {
+  return await response.text();
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("POST /v1/btw", () => {
+  // -- Validation (400s) --
+
+  test("returns 400 for missing conversationKey", async () => {
+    const res = await callHandler(
+      { content: "hello" },
+      { sendMessageDeps: makeSendMessageDeps() },
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as {
+      error: { code: string; message: string };
+    };
+    expect(body.error.code).toBe("BAD_REQUEST");
+    expect(body.error.message).toContain("conversationKey");
+  });
+
+  test("returns 400 for missing content", async () => {
+    const res = await callHandler(
+      { conversationKey: "key" },
+      { sendMessageDeps: makeSendMessageDeps() },
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as {
+      error: { code: string; message: string };
+    };
+    expect(body.error.code).toBe("BAD_REQUEST");
+    expect(body.error.message).toContain("content");
+  });
+
+  test("returns 400 for empty content", async () => {
+    const res = await callHandler(
+      { conversationKey: "key", content: "" },
+      { sendMessageDeps: makeSendMessageDeps() },
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as {
+      error: { code: string; message: string };
+    };
+    expect(body.error.code).toBe("BAD_REQUEST");
+    expect(body.error.message).toContain("content");
+  });
+
+  // -- Service unavailability (503) --
+
+  test("returns 503 when sendMessageDeps is unavailable", async () => {
+    const res = await callHandler(
+      { conversationKey: "key", content: "hello" },
+      { sendMessageDeps: undefined },
+    );
+    expect(res.status).toBe(503);
+    const body = (await res.json()) as {
+      error: { code: string; message: string };
+    };
+    expect(body.error.code).toBe("SERVICE_UNAVAILABLE");
+  });
+
+  // -- Successful SSE streaming --
+
+  test("streams btw_text_delta SSE events", async () => {
+    const res = await callHandler(
+      { conversationKey: "key", content: "hello" },
+      { sendMessageDeps: makeSendMessageDeps() },
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).toBe("text/event-stream");
+
+    const text = await readStream(res);
+    expect(text).toContain(`event: btw_text_delta\ndata: {"text":"hello"}`);
+  });
+
+  test("response ends with btw_complete", async () => {
+    const res = await callHandler(
+      { conversationKey: "key", content: "hello" },
+      { sendMessageDeps: makeSendMessageDeps() },
+    );
+    const text = await readStream(res);
+    expect(text).toContain("event: btw_complete\ndata: {}");
+  });
+
+  // -- Provider receives correct args --
+
+  test("provider receives session messages + btw user message, system prompt, tools, and tool_choice none", async () => {
+    const provider = makeMockProvider();
+    const session = makeMockSession(provider);
+    const deps = makeSendMessageDeps(session);
+
+    const res = await callHandler(
+      { conversationKey: "key", content: "  my question  " },
+      { sendMessageDeps: deps },
+    );
+    // Consume the stream to ensure the provider call completes
+    await readStream(res);
+
+    expect(provider.sendMessage).toHaveBeenCalledTimes(1);
+
+    const [messages, tools, systemPrompt, options] =
+      provider.sendMessage.mock.calls[0];
+
+    // Messages should be session messages + the new user message (trimmed)
+    expect(messages).toHaveLength(3);
+    expect(messages[0]).toEqual({
+      role: "user",
+      content: [{ type: "text", text: "prior message" }],
+    });
+    expect(messages[1]).toEqual({
+      role: "assistant",
+      content: [{ type: "text", text: "prior response" }],
+    });
+    expect(messages[2]).toEqual({
+      role: "user",
+      content: [{ type: "text", text: "my question" }],
+    });
+
+    // Tools
+    expect(tools).toEqual(MOCK_TOOLS);
+
+    // System prompt from session
+    expect(systemPrompt).toBe("You are a helpful assistant.");
+
+    // Options: tool_choice must be "none"
+    expect(options!.config!.tool_choice).toEqual({ type: "none" });
+  });
+
+  // -- No persistence --
+
+  test("does not persist any messages (addMessage never called)", async () => {
+    mockAddMessage.mockClear();
+
+    const res = await callHandler(
+      { conversationKey: "key", content: "hello" },
+      { sendMessageDeps: makeSendMessageDeps() },
+    );
+    await readStream(res);
+
+    expect(mockAddMessage).not.toHaveBeenCalled();
+  });
+
+  // -- session.processing not touched --
+
+  test("session.processing remains unchanged", async () => {
+    const session = makeMockSession();
+    const deps = makeSendMessageDeps(session);
+
+    // Verify initial state
+    expect(session.processing).toBe(false);
+
+    const res = await callHandler(
+      { conversationKey: "key", content: "hello" },
+      { sendMessageDeps: deps },
+    );
+    await readStream(res);
+
+    // processing should still be false — the handler never sets it
+    expect(session.processing).toBe(false);
+  });
+});

package/src/__tests__/bundled-asset.test.ts

@@ -124,7 +124,7 @@ describe("resolveBundledDir", () => {
       process.execPath = join(macosDir, "vellum-daemon");
 
       const result = resolveBundledDir(
-        "/$bunfs/root/src/home-base/prebuilt",
+        "/$bunfs/root/src/widgets/prebuilt",
         ".",
         "prebuilt",
       );