@vellumai/assistant 0.4.46 → 0.4.49

package/src/__tests__/gateway-only-enforcement.test.ts

@@ -112,9 +112,11 @@ mock.module("../calls/twilio-provider.js", () => ({
   },
 }));
 
+import { credentialKey } from "../security/credential-key.js";
+
 const secureKeyStore: Record<string, string | undefined> = {
-  "credential:twilio:account_sid": "AC_test",
-  "credential:twilio:auth_token": "test_token",
+  [credentialKey("twilio", "account_sid")]: "AC_test",
+  [credentialKey("twilio", "auth_token")]: "test_token",
 };
 
 mock.module("../security/secure-keys.js", () => ({

package/src/__tests__/gateway-only-guard.test.ts

@@ -37,7 +37,6 @@ const ALLOWLIST = new Set([
   // --- Documentation and comments that mention the port for explanatory purposes ---
   "AGENTS.md", // documents the gateway-only rule itself
   "ARCHITECTURE.md", // architecture overview with port references
-  "assistant/docs/runbook-trusted-contacts.md", // operator runbook targeting runtime-only /v1/contacts endpoints
   "assistant/src/runtime/middleware/twilio-validation.ts", // comment explaining proxy URL rewriting
 ]);
 

package/src/__tests__/gemini-image-service.test.ts

@@ -100,10 +100,13 @@ describe("generateImage", () => {
   test("generate mode returns images from response parts", async () => {
     fakeResponse = imageResponse("image/png", "abc123");
 
-    const result = await generateImage("test-key", {
-      prompt: "a cat",
-      mode: "generate",
-    });
+    const result = await generateImage(
+      { type: "direct", apiKey: "test-key" },
+      {
+        prompt: "a cat",
+        mode: "generate",
+      },
+    );
 
     expect(result.images).toHaveLength(1);
     expect(result.images[0].mimeType).toBe("image/png");
@@ -114,10 +117,13 @@ describe("generateImage", () => {
   test("generate mode collects text commentary from response", async () => {
     fakeResponse = imageWithTextResponse("Here is your image");
 
-    const result = await generateImage("test-key", {
-      prompt: "a dog",
-      mode: "generate",
-    });
+    const result = await generateImage(
+      { type: "direct", apiKey: "test-key" },
+      {
+        prompt: "a dog",
+        mode: "generate",
+      },
+    );
 
     expect(result.text).toBe("Here is your image");
     expect(result.images).toHaveLength(1);
@@ -126,11 +132,14 @@ describe("generateImage", () => {
   test("edit mode passes source images as inline data", async () => {
     fakeResponse = imageResponse();
 
-    await generateImage("test-key", {
-      prompt: "remove background",
-      mode: "edit",
-      sourceImages: [{ mimeType: "image/jpeg", dataBase64: "srcdata" }],
-    });
+    await generateImage(
+      { type: "direct", apiKey: "test-key" },
+      {
+        prompt: "remove background",
+        mode: "edit",
+        sourceImages: [{ mimeType: "image/jpeg", dataBase64: "srcdata" }],
+      },
+    );
 
     expect(lastGenerateParams).not.toBeNull();
     const contents = (lastGenerateParams as Record<string, unknown>)
@@ -148,11 +157,14 @@ describe("generateImage", () => {
   test("model validation rejects unknown models and defaults", async () => {
     fakeResponse = imageResponse();
 
-    await generateImage("test-key", {
-      prompt: "test",
-      mode: "generate",
-      model: "invalid-model",
-    });
+    await generateImage(
+      { type: "direct", apiKey: "test-key" },
+      {
+        prompt: "test",
+        mode: "generate",
+        model: "invalid-model",
+      },
+    );
 
     expect(lastGenerateParams).not.toBeNull();
     expect((lastGenerateParams as Record<string, unknown>).model).toBe(
@@ -163,11 +175,14 @@ describe("generateImage", () => {
   test("model validation accepts allowed models", async () => {
     fakeResponse = imageResponse();
 
-    await generateImage("test-key", {
-      prompt: "test",
-      mode: "generate",
-      model: "gemini-3-pro-image",
-    });
+    await generateImage(
+      { type: "direct", apiKey: "test-key" },
+      {
+        prompt: "test",
+        mode: "generate",
+        model: "gemini-3-pro-image",
+      },
+    );
 
     expect((lastGenerateParams as Record<string, unknown>).model).toBe(
       "gemini-3-pro-image",
@@ -177,11 +192,14 @@ describe("generateImage", () => {
   test("variants makes parallel calls", async () => {
     fakeResponse = imageResponse();
 
-    const result = await generateImage("test-key", {
-      prompt: "test",
-      mode: "generate",
-      variants: 3,
-    });
+    const result = await generateImage(
+      { type: "direct", apiKey: "test-key" },
+      {
+        prompt: "test",
+        mode: "generate",
+        variants: 3,
+      },
+    );
 
     expect(generateCallCount).toBe(3);
     expect(result.images).toHaveLength(3);
@@ -190,11 +208,14 @@ describe("generateImage", () => {
   test("variants are clamped to 1-4", async () => {
     fakeResponse = imageResponse();
 
-    await generateImage("test-key", {
-      prompt: "test",
-      mode: "generate",
-      variants: 10,
-    });
+    await generateImage(
+      { type: "direct", apiKey: "test-key" },
+      {
+        prompt: "test",
+        mode: "generate",
+        variants: 10,
+      },
+    );
 
     expect(generateCallCount).toBe(4);
   });
@@ -202,10 +223,13 @@ describe("generateImage", () => {
   test("variants defaults to 1", async () => {
     fakeResponse = imageResponse();
 
-    await generateImage("test-key", {
-      prompt: "test",
-      mode: "generate",
-    });
+    await generateImage(
+      { type: "direct", apiKey: "test-key" },
+      {
+        prompt: "test",
+        mode: "generate",
+      },
+    );
 
     expect(generateCallCount).toBe(1);
   });
@@ -213,10 +237,13 @@ describe("generateImage", () => {
   test("handles empty candidates gracefully", async () => {
     fakeResponse = { candidates: [] };
 
-    const result = await generateImage("test-key", {
-      prompt: "test",
-      mode: "generate",
-    });
+    const result = await generateImage(
+      { type: "direct", apiKey: "test-key" },
+      {
+        prompt: "test",
+        mode: "generate",
+      },
+    );
 
     expect(result.images).toHaveLength(0);
     expect(result.text).toBeUndefined();
@@ -225,10 +252,13 @@ describe("generateImage", () => {
   test("response config includes TEXT and IMAGE modalities", async () => {
     fakeResponse = imageResponse();
 
-    await generateImage("test-key", {
-      prompt: "test",
-      mode: "generate",
-    });
+    await generateImage(
+      { type: "direct", apiKey: "test-key" },
+      {
+        prompt: "test",
+        mode: "generate",
+      },
+    );
 
     const config = (lastGenerateParams as Record<string, unknown>)
       .config as Record<string, unknown>;

package/src/__tests__/gemini-provider.test.ts

@@ -739,14 +739,17 @@ describe("GeminiProvider", () => {
     expect(lastConstructorOpts).toEqual({ apiKey: "test-key" });
   });
 
-  test("sets httpOptions.baseUrl when managedBaseUrl is provided", () => {
+  test("sets vertexai mode with httpOptions.baseUrl when managedBaseUrl is provided", () => {
     new GeminiProvider("managed-key", "gemini-3-flash", {
-      managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
+      managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/vertex",
     });
     expect(lastConstructorOpts).toEqual({
-      apiKey: "managed-key",
+      vertexai: true,
+      project: "proxy",
+      location: "us-central1",
       httpOptions: {
-        baseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
+        baseUrl: "https://platform.example.com/v1/runtime-proxy/vertex",
+        headers: { Authorization: "Bearer managed-key" },
       },
     });
   });
@@ -756,7 +759,7 @@ describe("GeminiProvider", () => {
       "managed-key",
       "gemini-3-flash",
       {
-        managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
+        managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/vertex",
       },
     );
 
@@ -781,7 +784,7 @@ describe("GeminiProvider", () => {
       "managed-key",
       "gemini-3-flash",
       {
-        managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
+        managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/vertex",
       },
     );
 

package/src/__tests__/guardian-action-conversation-turn.test.ts

@@ -181,25 +181,6 @@ describe("guardian-action-conversation-turn", () => {
     expect(result.replyText).toBe("Sure, I'll call them back right away.");
   });
 
-  test('classifies "send a text message" as message_back', async () => {
-    const generator = createMockGenerator({
-      disposition: "message_back",
-      replyText: "Got it, I'll send them a text message.",
-    });
-
-    const result = await processGuardianFollowUpTurn(
-      {
-        questionText: "What is the gate code?",
-        lateAnswerText: "The gate code is 1234",
-        guardianReply: "Just send them a text",
-      },
-      generator,
-    );
-
-    expect(result.disposition).toBe("message_back");
-    expect(result.replyText).toBe("Got it, I'll send them a text message.");
-  });
-
   test('classifies "never mind" as decline', async () => {
     const generator = createMockGenerator({
       disposition: "decline",
@@ -448,19 +429,6 @@ describe("guardian-action-conversation-turn", () => {
     expect(updated!.followupAction).toBe("call_back");
   });
 
-  test("message_back disposition transitions to dispatching with message_back action", () => {
-    const { request } = createAwaitingChoiceRequest("conv-turn-7");
-
-    const updated = progressFollowupState(
-      request.id,
-      "dispatching",
-      "message_back",
-    );
-    expect(updated).not.toBeNull();
-    expect(updated!.followupState).toBe("dispatching");
-    expect(updated!.followupAction).toBe("message_back");
-  });
-
   test("decline disposition finalizes to declined", () => {
     const { request } = createAwaitingChoiceRequest("conv-turn-8");
 
@@ -488,7 +456,7 @@ describe("guardian-action-conversation-turn", () => {
     const second = progressFollowupState(
       request.id,
       "dispatching",
-      "message_back",
+      "call_back",
     );
     expect(second).toBeNull();
 

package/src/__tests__/guardian-action-copy-generator.test.ts

@@ -33,8 +33,6 @@ const ALL_SCENARIOS: GuardianActionMessageScenario[] = [
   "guardian_superseded_remap",
   "guardian_unknown_code",
   "guardian_auto_matched",
-  "outbound_message_copy",
-  "followup_message_sent",
   "followup_call_started",
   "followup_action_failed",
   "guardian_answer_delivery_failed",
@@ -110,24 +108,6 @@ describe("guardian-action-copy-generator", () => {
       });
       expect(msg).toContain("QFOO12");
     });
-
-    test("outbound_message_copy includes lateAnswerText and questionText", () => {
-      const msg = getGuardianActionFallbackMessage({
-        scenario: "outbound_message_copy",
-        questionText: "When is the appointment?",
-        lateAnswerText: "It is at 3pm tomorrow.",
-      });
-      expect(msg).toContain("When is the appointment?");
-      expect(msg).toContain("It is at 3pm tomorrow.");
-    });
-
-    test("outbound_message_copy without lateAnswerText still includes questionText", () => {
-      const msg = getGuardianActionFallbackMessage({
-        scenario: "outbound_message_copy",
-        questionText: "Is the office open?",
-      });
-      expect(msg).toContain("Is the office open?");
-    });
   });
 
   // -----------------------------------------------------------------------

package/src/__tests__/guardian-action-followup-executor.test.ts

@@ -127,10 +127,7 @@ function resetTables(): void {
  * Create a request in `dispatching` state ready for the executor.
  * The call session has fromNumber='+15550001111' (the counterparty).
  */
-function createDispatchingRequest(
-  convId: string,
-  action: "call_back" | "message_back",
-) {
+function createDispatchingRequest(convId: string, action: "call_back") {
   ensureConversation(convId);
   const session = createCallSession({
     conversationId: convId,
@@ -284,30 +281,6 @@ describe("guardian-action-followup-executor", () => {
     });
   });
 
-  // ── message_back (unsupported) error path ─────────────────────────────
-
-  describe("message_back", () => {
-    test("returns failure and finalizes as failed when message_back is dispatched", async () => {
-      const { request } = createDispatchingRequest(
-        "exec-msg-1",
-        "message_back",
-      );
-
-      const result = await executeFollowupAction(request.id, "message_back");
-
-      expect(result.ok).toBe(false);
-      if (!result.ok) {
-        expect(result.error).toContain("Unsupported action");
-        expect(result.error).toContain("message_back");
-      }
-      expect(result.guardianReplyText.length).toBeGreaterThan(0);
-
-      const updated = getGuardianActionRequest(request.id);
-      expect(updated!.followupState).toBe("failed");
-      expect(updated!.followupCompletedAt).toBeGreaterThan(0);
-    });
-  });
-
   // ── Error handling ──────────────────────────────────────────────────
 
   describe("error handling", () => {

package/src/__tests__/guardian-action-followup-store.test.ts

@@ -314,7 +314,7 @@ describe("guardian-action-followup-store", () => {
     const request = createTestRequest("conv-followup-15");
     markTimedOutWithReason(request.id, "call_timeout");
     startFollowupFromExpiredRequest(request.id, "Late answer");
-    progressFollowupState(request.id, "dispatching", "message_back");
+    progressFollowupState(request.id, "dispatching", "call_back");
 
     const result = finalizeFollowup(request.id, "failed");
     expect(result).not.toBeNull();

package/src/__tests__/guardian-action-grant-mint-consume.test.ts

@@ -35,7 +35,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/guardian-decision-primitive-canonical.test.ts

@@ -21,7 +21,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/guardian-grant-minting.test.ts

@@ -50,6 +50,7 @@ import type { TrustContext } from "../daemon/session-runtime-assembly.js";
 import { getDb, initializeDb, resetDb } from "../memory/db.js";
 import {
   createApprovalRequest,
+  getPendingApprovalForRequest,
   type GuardianApprovalRequest,
 } from "../memory/guardian-approvals.js";
 import * as approvalMessageComposer from "../runtime/approval-message-composer.js";
@@ -247,6 +248,40 @@ describe("guardian grant minting on tool-approval decisions", () => {
     composeSpy.mockRestore();
   });
 
+  test("guardian reaction approve_always is downgraded to one-time approval", async () => {
+    const requestId = "req-grant-reaction-1";
+    const approval = createTestGuardianApproval(requestId, {
+      conversationId: CONVERSATION_ID,
+      channel: "slack",
+      guardianChatId: GUARDIAN_CHAT,
+    });
+    const handleConfirmationResponse = registerPendingInteraction(
+      requestId,
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: "guardian-conv-1",
+      callbackData: "reaction:white_check_mark",
+      content: "",
+      conversationExternalId: GUARDIAN_CHAT,
+      sourceChannel: "slack",
+      actorExternalId: GUARDIAN_USER,
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: makeTrustContext(),
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("guardian_decision_applied");
+    expect(handleConfirmationResponse).toHaveBeenCalledWith(requestId, "allow");
+
+    const updatedApproval = getPendingApprovalForRequest(approval.requestId);
+    expect(updatedApproval).toBeNull();
+  });
+
   // ── 2. approve_once for non-tool-approval does NOT mint a grant ──
 
   test("approve_once for informational request (no toolName) does NOT mint a grant", async () => {

package/src/__tests__/guardian-routing-invariants.test.ts

@@ -42,7 +42,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/guardian-verification-voice-binding.test.ts

@@ -57,7 +57,6 @@ mock.module("../security/secure-keys.js", () => ({
 
 mock.module("../config/env.js", () => ({
   isHttpAuthDisabled: () => true,
-  getTwilioUserPhoneNumber: () => null,
 }));
 
 mock.module("../inbound/public-ingress-urls.js", () => ({

package/src/__tests__/handlers-user-message-approval-consumption.test.ts

@@ -147,7 +147,6 @@ import { handleConfirmationResponse } from "../daemon/handlers/sessions.js";
 
 interface TestSession {
   messages: Array<{ role: string; content: unknown[] }>;
-  hasEscalationHandler: () => boolean;
   setChannelCapabilities: (caps: unknown) => void;
   isProcessing: () => boolean;
   hasPendingConfirmation: (requestId: string) => boolean;
@@ -181,8 +180,6 @@ function createContext(session: TestSession): {
   const sent: ServerMessage[] = [];
   const ctx: HandlerContext = {
     sessions: new Map(),
-    cuSessions: new Map(),
-    cuObservationParseSequence: new Map(),
     sharedRequestTimestamps: [],
     debounceTimers: new DebouncerMap({ defaultDelayMs: 100 }),
     suppressConfigReload: false,
@@ -202,7 +199,6 @@ function createContext(session: TestSession): {
 function makeSession(overrides: Partial<TestSession> = {}): TestSession {
   return {
     messages: [],
-    hasEscalationHandler: () => true,
     setChannelCapabilities: () => {},
     isProcessing: () => false,
     hasPendingConfirmation: () => true,
@@ -277,39 +273,4 @@ describe("handleConfirmationResponse canonical status sync", () => {
     );
     expect(resolveMock).toHaveBeenCalledWith("req-confirm-allow");
   });
-
-  test("syncs canonical status to denied for deny decisions in CU sessions", () => {
-    const cuSession = {
-      hasPendingConfirmation: (requestId: string) =>
-        requestId === "req-confirm-deny",
-      handleConfirmationResponse: mock(() => {}),
-    };
-    const { ctx } = createContext(
-      makeSession({
-        hasPendingConfirmation: () => false,
-      }),
-    );
-    ctx.cuSessions.set("cu-1", cuSession as any);
-
-    const msg: ConfirmationResponse = {
-      type: "confirmation_response",
-      requestId: "req-confirm-deny",
-      decision: "always_deny",
-    };
-
-    handleConfirmationResponse(msg, ctx);
-
-    expect(
-      (cuSession.handleConfirmationResponse as any).mock.calls.length,
-    ).toBe(1);
-    expect((cuSession.handleConfirmationResponse as any).mock.calls[0]).toEqual(
-      ["req-confirm-deny", "always_deny", undefined, undefined],
-    );
-    expect(resolveCanonicalGuardianRequestMock).toHaveBeenCalledWith(
-      "req-confirm-deny",
-      "pending",
-      { status: "denied" },
-    );
-    expect(resolveMock).toHaveBeenCalledWith("req-confirm-deny");
-  });
 });

package/src/__tests__/heartbeat-service.test.ts

@@ -67,7 +67,6 @@ mock.module("../util/logger.js", () => ({
     warn: () => {},
     error: () => {},
   }),
-  isDebug: () => false,
 }));
 
 // Mock conversation title service