@vellumai/assistant 0.4.48 → 0.4.49

package/src/__tests__/credentials-cli.test.ts

@@ -164,6 +164,26 @@ mock.module("../tools/credentials/metadata-store.js", () => ({
   },
 }));
 
+// ---------------------------------------------------------------------------
+// Mock oauth-store
+// ---------------------------------------------------------------------------
+
+let disconnectOAuthProviderCalls: string[] = [];
+let disconnectOAuthProviderResult: "disconnected" | "not-found" | "error" =
+  "not-found";
+
+mock.module("../oauth/oauth-store.js", () => ({
+  disconnectOAuthProvider: async (
+    providerKey: string,
+  ): Promise<"disconnected" | "not-found" | "error"> => {
+    disconnectOAuthProviderCalls.push(providerKey);
+    return disconnectOAuthProviderResult;
+  },
+  getConnectionByProvider: (): undefined => undefined,
+  listConnections: (): never[] => [],
+  deleteConnection: (): boolean => false,
+}));
+
 // ---------------------------------------------------------------------------
 // Import the module under test (after mocks are registered)
 // ---------------------------------------------------------------------------
@@ -281,6 +301,8 @@ describe("assistant credentials CLI", () => {
     _listMetadataCalls = 0;
     _getMetadataCalls = 0;
     _getMetadataByIdCalls = 0;
+    disconnectOAuthProviderCalls = [];
+    disconnectOAuthProviderResult = "not-found";
     process.exitCode = 0;
   });
 
@@ -611,6 +633,55 @@ describe("assistant credentials CLI", () => {
         ),
       ).toBeUndefined();
     });
+
+    test("calls disconnectOAuthProvider for OAuth cleanup", async () => {
+      seedCredential("gmail", "access_token", "ya29.token_value");
+
+      const result = await runCli(["delete", "gmail:access_token", "--json"]);
+      expect(result.exitCode).toBe(0);
+      const parsed = JSON.parse(result.stdout);
+      expect(parsed.ok).toBe(true);
+
+      // disconnectOAuthProvider should have been called with the service name
+      expect(disconnectOAuthProviderCalls).toEqual(["gmail"]);
+    });
+
+    test("succeeds when only OAuth connection exists (no legacy credential)", async () => {
+      // No legacy credential seeded — only the OAuth disconnect finds something
+      disconnectOAuthProviderResult = "disconnected";
+
+      const result = await runCli(["delete", "gmail:access_token", "--json"]);
+      expect(result.exitCode).toBe(0);
+      const parsed = JSON.parse(result.stdout);
+      expect(parsed.ok).toBe(true);
+      expect(parsed.service).toBe("gmail");
+      expect(parsed.field).toBe("access_token");
+
+      expect(disconnectOAuthProviderCalls).toEqual(["gmail"]);
+    });
+
+    test("demonstrates colon-in-service-name parsing limitation with integration:gmail", async () => {
+      // parseCredentialName("integration:gmail:access_token") splits on the
+      // first colon, yielding service="integration" and field="gmail:access_token".
+      // This is incorrect for the intended service "integration:gmail". The fix
+      // for this limitation is addressed by introducing a dedicated `disconnect`
+      // subcommand (PR 5).
+      const result = await runCli([
+        "delete",
+        "integration:gmail:access_token",
+        "--json",
+      ]);
+      // The command parses as service="integration", field="gmail:access_token"
+      // which finds nothing and reports not-found.
+      expect(result.exitCode).toBe(1);
+      const parsed = JSON.parse(result.stdout);
+      expect(parsed.ok).toBe(false);
+      expect(parsed.error).toContain("not found");
+
+      // disconnectOAuthProvider was called with "integration" (wrong) instead
+      // of "integration:gmail" (intended).
+      expect(disconnectOAuthProviderCalls).toEqual(["integration"]);
+    });
   });
 
   // =========================================================================

package/src/__tests__/dynamic-skill-workflow-prompt.test.ts

@@ -46,7 +46,6 @@ mock.module("../util/logger.js", () => ({
   ...realLogger,
   getLogger: () => noopLogger,
   getCliLogger: () => noopLogger,
-  isDebug: () => false,
   truncateForLog: (v: string) => v,
   initLogger: () => {},
   pruneOldLogFiles: () => 0,

package/src/__tests__/ephemeral-permissions.test.ts

@@ -328,11 +328,11 @@ describe("ephemeral-permissions", () => {
       testConfig.permissions.mode = "workspace";
     });
 
-    test("workspace mode auto-allows workspace-scoped file_write (medium risk)", async () => {
+    test("workspace mode prompts for workspace-scoped file_write (medium risk)", async () => {
       const filePath = join(testDir, "workspace-test-file.txt");
       const result = await check("file_write", { path: filePath }, testDir);
-      expect(result.decision).toBe("allow");
-      expect(result.reason).toContain("Workspace mode");
+      expect(result.decision).toBe("prompt");
+      expect(result.reason).toContain("medium risk");
     });
 
     test("workspace mode still prompts for file_write outside workspace", async () => {

package/src/__tests__/gateway-only-guard.test.ts

@@ -37,7 +37,6 @@ const ALLOWLIST = new Set([
   // --- Documentation and comments that mention the port for explanatory purposes ---
   "AGENTS.md", // documents the gateway-only rule itself
   "ARCHITECTURE.md", // architecture overview with port references
-  "assistant/docs/runbook-trusted-contacts.md", // operator runbook targeting runtime-only /v1/contacts endpoints
   "assistant/src/runtime/middleware/twilio-validation.ts", // comment explaining proxy URL rewriting
 ]);
 

package/src/__tests__/guardian-action-grant-mint-consume.test.ts

@@ -35,7 +35,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/guardian-decision-primitive-canonical.test.ts

@@ -21,7 +21,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/guardian-routing-invariants.test.ts

@@ -42,7 +42,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/guardian-verification-voice-binding.test.ts

@@ -57,7 +57,6 @@ mock.module("../security/secure-keys.js", () => ({
 
 mock.module("../config/env.js", () => ({
   isHttpAuthDisabled: () => true,
-  getTwilioUserPhoneNumber: () => null,
 }));
 
 mock.module("../inbound/public-ingress-urls.js", () => ({

package/src/__tests__/handlers-user-message-approval-consumption.test.ts

@@ -147,7 +147,6 @@ import { handleConfirmationResponse } from "../daemon/handlers/sessions.js";
 
 interface TestSession {
   messages: Array<{ role: string; content: unknown[] }>;
-  hasEscalationHandler: () => boolean;
   setChannelCapabilities: (caps: unknown) => void;
   isProcessing: () => boolean;
   hasPendingConfirmation: (requestId: string) => boolean;
@@ -181,8 +180,6 @@ function createContext(session: TestSession): {
   const sent: ServerMessage[] = [];
   const ctx: HandlerContext = {
     sessions: new Map(),
-    cuSessions: new Map(),
-    cuObservationParseSequence: new Map(),
     sharedRequestTimestamps: [],
     debounceTimers: new DebouncerMap({ defaultDelayMs: 100 }),
     suppressConfigReload: false,
@@ -202,7 +199,6 @@ function createContext(session: TestSession): {
 function makeSession(overrides: Partial<TestSession> = {}): TestSession {
   return {
     messages: [],
-    hasEscalationHandler: () => true,
     setChannelCapabilities: () => {},
     isProcessing: () => false,
     hasPendingConfirmation: () => true,
@@ -277,39 +273,4 @@ describe("handleConfirmationResponse canonical status sync", () => {
     );
     expect(resolveMock).toHaveBeenCalledWith("req-confirm-allow");
   });
-
-  test("syncs canonical status to denied for deny decisions in CU sessions", () => {
-    const cuSession = {
-      hasPendingConfirmation: (requestId: string) =>
-        requestId === "req-confirm-deny",
-      handleConfirmationResponse: mock(() => {}),
-    };
-    const { ctx } = createContext(
-      makeSession({
-        hasPendingConfirmation: () => false,
-      }),
-    );
-    ctx.cuSessions.set("cu-1", cuSession as any);
-
-    const msg: ConfirmationResponse = {
-      type: "confirmation_response",
-      requestId: "req-confirm-deny",
-      decision: "always_deny",
-    };
-
-    handleConfirmationResponse(msg, ctx);
-
-    expect(
-      (cuSession.handleConfirmationResponse as any).mock.calls.length,
-    ).toBe(1);
-    expect((cuSession.handleConfirmationResponse as any).mock.calls[0]).toEqual(
-      ["req-confirm-deny", "always_deny", undefined, undefined],
-    );
-    expect(resolveCanonicalGuardianRequestMock).toHaveBeenCalledWith(
-      "req-confirm-deny",
-      "pending",
-      { status: "denied" },
-    );
-    expect(resolveMock).toHaveBeenCalledWith("req-confirm-deny");
-  });
 });

package/src/__tests__/heartbeat-service.test.ts

@@ -67,7 +67,6 @@ mock.module("../util/logger.js", () => ({
     warn: () => {},
     error: () => {},
   }),
-  isDebug: () => false,
 }));
 
 // Mock conversation title service