@vellumai/assistant 0.4.48 → 0.4.50

package/src/__tests__/telegram-invite-adapter.test.ts

@@ -7,44 +7,42 @@
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { ChannelId } from "../channels/types.js";
-import { telegramInviteAdapter } from "../runtime/channel-invite-transports/telegram.js";
 
 // Mock credential metadata so tests don't depend on local persisted state.
 mock.module("../tools/credentials/metadata-store.js", () => ({
   getCredentialMetadata: () => undefined,
 }));
 
+// Mock getTelegramBotUsername — the env var fallback was removed so we
+// control the return value directly via a mutable variable.
+let mockBotUsername: string | undefined;
+mock.module("../telegram/bot-username.js", () => ({
+  getTelegramBotUsername: () => mockBotUsername,
+}));
+
+import { telegramInviteAdapter } from "../runtime/channel-invite-transports/telegram.js";
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 
 const CHANNEL: ChannelId = "telegram" as ChannelId;
 
-function setEnv(key: string, value: string | undefined) {
-  if (value === undefined) {
-    delete process.env[key];
-  } else {
-    process.env[key] = value;
-  }
-}
-
 // ---------------------------------------------------------------------------
 // buildShareLink
 // ---------------------------------------------------------------------------
 
 describe("telegramInviteAdapter.buildShareLink", () => {
-  let originalBotUsername: string | undefined;
-
   beforeEach(() => {
-    originalBotUsername = process.env.TELEGRAM_BOT_USERNAME;
+    mockBotUsername = undefined;
   });
 
   afterEach(() => {
-    setEnv("TELEGRAM_BOT_USERNAME", originalBotUsername);
+    mockBotUsername = undefined;
   });
 
   test("builds a deep link with iv_ prefix", () => {
-    setEnv("TELEGRAM_BOT_USERNAME", "TestBot");
+    mockBotUsername = "TestBot";
 
     const link = telegramInviteAdapter.buildShareLink!({
       rawToken: "abc123",
@@ -56,7 +54,7 @@ describe("telegramInviteAdapter.buildShareLink", () => {
   });
 
   test("throws when bot username is not configured", () => {
-    setEnv("TELEGRAM_BOT_USERNAME", undefined);
+    mockBotUsername = undefined;
 
     expect(() =>
       telegramInviteAdapter.buildShareLink!({
@@ -138,25 +136,23 @@ describe("telegramInviteAdapter.extractInboundToken", () => {
 // ---------------------------------------------------------------------------
 
 describe("telegramInviteAdapter.resolveChannelHandle", () => {
-  let originalBotUsername: string | undefined;
-
   beforeEach(() => {
-    originalBotUsername = process.env.TELEGRAM_BOT_USERNAME;
+    mockBotUsername = undefined;
   });
 
   afterEach(() => {
-    setEnv("TELEGRAM_BOT_USERNAME", originalBotUsername);
+    mockBotUsername = undefined;
   });
 
-  test("returns @-prefixed bot username from env", () => {
-    setEnv("TELEGRAM_BOT_USERNAME", "MyBot");
+  test("returns @-prefixed bot username from config", () => {
+    mockBotUsername = "MyBot";
 
     const handle = telegramInviteAdapter.resolveChannelHandle!();
     expect(handle).toBe("@MyBot");
   });
 
   test("returns undefined when bot username is not configured", () => {
-    setEnv("TELEGRAM_BOT_USERNAME", undefined);
+    mockBotUsername = undefined;
 
     const handle = telegramInviteAdapter.resolveChannelHandle!();
     expect(handle).toBeUndefined();

package/src/__tests__/terminal-tools.test.ts

@@ -457,10 +457,10 @@ describe("buildSanitizedEnv", () => {
   });
 
   test("injects INTERNAL_GATEWAY_BASE_URL from gateway config", () => {
-    process.env.GATEWAY_INTERNAL_BASE_URL = "http://gateway.internal:9000/";
+    process.env.GATEWAY_PORT = "9000";
     const env = buildSanitizedEnv();
-    expect(env.INTERNAL_GATEWAY_BASE_URL).toBe("http://gateway.internal:9000");
-    delete process.env.GATEWAY_INTERNAL_BASE_URL;
+    expect(env.INTERNAL_GATEWAY_BASE_URL).toBe("http://127.0.0.1:9000");
+    delete process.env.GATEWAY_PORT;
   });
 
   test("result is a plain object with no prototype-inherited secrets", () => {
@@ -485,6 +485,7 @@ describe("buildSanitizedEnv", () => {
       "SSH_AGENT_PID",
       "GPG_TTY",
       "GNUPGHOME",
+      "VELLUM_DEV",
       "INTERNAL_GATEWAY_BASE_URL",
       "VELLUM_DATA_DIR",
     ];

package/src/__tests__/test-support/computer-use-skill-harness.ts

@@ -2,8 +2,9 @@
  * Reusable constants and helpers for the computer-use skill migration test suite.
  */
 
-/** The 10 computer_use_* action tool names provided by the bundled computer-use skill. */
+/** The 11 computer_use_* action tool names provided by the bundled computer-use skill. */
 export const COMPUTER_USE_TOOL_NAMES = [
+  "computer_use_observe",
   "computer_use_click",
   "computer_use_type_text",
   "computer_use_key",
@@ -20,7 +21,7 @@ export const COMPUTER_USE_TOOL_NAMES = [
 export const COMPUTER_USE_SKILL_ID = "computer-use";
 
 /** Number of computer_use_* tools. */
-export const COMPUTER_USE_TOOL_COUNT = COMPUTER_USE_TOOL_NAMES.length; // 10
+export const COMPUTER_USE_TOOL_COUNT = COMPUTER_USE_TOOL_NAMES.length; // 11
 
 import { expect } from "bun:test";
 

package/src/__tests__/tool-approval-handler.test.ts

@@ -21,7 +21,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/tool-execution-pipeline.benchmark.test.ts

@@ -44,7 +44,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
 }));
 
 // Allow toggling between no-rule and matched-rule paths

package/src/__tests__/tool-executor-lifecycle-events.test.ts

@@ -59,7 +59,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/tool-executor-shell-integration.test.ts

@@ -68,7 +68,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/tool-executor.test.ts

@@ -103,7 +103,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/tool-grant-request-escalation.test.ts

@@ -31,7 +31,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/trust-store-pattern-matches.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, test } from "bun:test";
+
+import { patternMatchesCandidate } from "../permissions/trust-store.js";
+
+describe("patternMatchesCandidate", () => {
+  test("exact match", () => {
+    expect(patternMatchesCandidate("bash:git commit", "bash:git commit")).toBe(
+      true,
+    );
+  });
+
+  test("glob match", () => {
+    expect(patternMatchesCandidate("bash:git *", "bash:git commit")).toBe(true);
+  });
+
+  test("no match", () => {
+    expect(patternMatchesCandidate("bash:git *", "file_write:/foo")).toBe(
+      false,
+    );
+  });
+
+  test("globstar matches anything", () => {
+    expect(patternMatchesCandidate("**", "bash:anything")).toBe(true);
+  });
+
+  test("invalid pattern returns false", () => {
+    expect(patternMatchesCandidate("[", "bash:anything")).toBe(false);
+  });
+});

package/src/__tests__/trust-store.test.ts

@@ -777,8 +777,8 @@ describe("Trust Store", () => {
         "computer_use_click",
         "computer_use_drag",
         "computer_use_key",
+        "computer_use_observe",
         "computer_use_open_app",
-        "computer_use_request_control",
         "computer_use_run_applescript",
         "computer_use_scroll",
         "computer_use_type_text",
@@ -901,19 +901,17 @@ describe("Trust Store", () => {
       );
     });
 
-    test("findHighestPriorityRule matches default ask for computer_use_request_control", () => {
+    test("findHighestPriorityRule matches default ask for computer_use_observe", () => {
       const match = findHighestPriorityRule(
-        "computer_use_request_control",
-        ["computer_use_request_control:"],
+        "computer_use_observe",
+        ["computer_use_observe:"],
         "/tmp",
       );
       expect(match).not.toBeNull();
-      expect(match!.id).toBe("default:ask-computer_use_request_control-global");
+      expect(match!.id).toBe("default:ask-computer_use_observe-global");
       expect(match!.decision).toBe("ask");
       expect(match!.priority).toBe(
-        DEFAULT_PRIORITY_BY_ID.get(
-          "default:ask-computer_use_request_control-global",
-        )!,
+        DEFAULT_PRIORITY_BY_ID.get("default:ask-computer_use_observe-global")!,
       );
     });
 
@@ -1755,11 +1753,7 @@ describe("computer-use tool trust rule matching", () => {
   test("actionable CU tools have default ask trust rules", () => {
     // Actionable CU tools (those that perform screen interactions) should
     // have default "ask" rules so strict mode prompts before use.
-    const actionableCuTools = [
-      "computer_use_click",
-      "computer_use_type_text",
-      "computer_use_request_control",
-    ];
+    const actionableCuTools = ["computer_use_click", "computer_use_type_text"];
 
     for (const name of actionableCuTools) {
       const rule = findHighestPriorityRule(name, [name], "/tmp/test");

package/src/__tests__/trusted-contact-approval-notifier.test.ts

@@ -42,7 +42,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/trusted-contact-inline-approval-integration.test.ts

@@ -45,7 +45,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/twilio-routes.test.ts

@@ -77,7 +77,6 @@ function resolveIngressBaseUrlFromConfig(ingressConfig: unknown): string {
 
 mock.module("../config/env.js", () => ({
   isHttpAuthDisabled: () => true,
-  getCallWelcomeGreeting: () => process.env.CALL_WELCOME_GREETING || undefined,
   getGatewayInternalBaseUrl: () => "http://gateway.internal:7830",
   getIngressPublicBaseUrl: () => mockIngressPublicBaseUrl,
   setIngressPublicBaseUrl: (value: string | undefined) => {
@@ -109,13 +108,11 @@ mock.module("../util/logger.js", () => ({
     debug: () => {},
     trace: () => {},
     fatal: () => {},
-    isDebug: () => false,
     child: () => ({
       info: () => {},
       warn: () => {},
       error: () => {},
       debug: () => {},
-      isDebug: () => false,
     }),
   }),
 }));
@@ -438,7 +435,6 @@ describe("twilio webhook routes", () => {
     updatePhoneNumberWebhookCalls = [];
     mockTwilioApiValidationStatus = 200;
     mockTwilioApiValidationBody = JSON.stringify({ sid: "AC_validated" });
-    delete process.env.CALL_WELCOME_GREETING;
 
     globalThis.fetch = (async (
       url: string | URL | Request,
@@ -819,18 +815,6 @@ describe("twilio webhook routes", () => {
       const twiml = await res.text();
       expect(twiml).not.toContain("welcomeGreeting=");
     });
-
-    test("TwiML includes explicit welcome greeting override when configured", async () => {
-      process.env.CALL_WELCOME_GREETING = "Custom transport greeting";
-      const session = createTestSession("conv-twiml-4", "CA_twiml_4");
-      const req = makeVoiceRequest(session.id, { CallSid: "CA_twiml_4" });
-
-      const res = await handleVoiceWebhook(req);
-
-      expect(res.status).toBe(200);
-      const twiml = await res.text();
-      expect(twiml).toContain('welcomeGreeting="Custom transport greeting"');
-    });
   });
 
   // ── Handler-level idempotency concurrency tests ─────────────────

package/src/__tests__/verification-control-plane-policy.test.ts

@@ -64,7 +64,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));
 

package/src/__tests__/voice-invite-redemption.test.ts

@@ -23,7 +23,10 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-import { findContactChannel } from "../contacts/contact-store.js";
+import {
+  findContactChannel,
+  upsertContact,
+} from "../contacts/contact-store.js";
 import { upsertContactChannel } from "../contacts/contacts-write.js";
 import { getSqlite, initializeDb, resetDb } from "../memory/db.js";
 import { createInvite, revokeInvite } from "../memory/invite-store.js";
@@ -354,4 +357,32 @@ describe("redeemVoiceInviteCode", () => {
 
     expect(result).toEqual({ ok: false, reason: "invalid_or_expired" });
   });
+
+  test("returns invalid_or_expired for a revoked guardian to prevent invite-based reactivation", () => {
+    const phone = "+15559998888";
+    const { code } = createVoiceInvite({ callerPhone: phone });
+
+    // Pre-create a guardian contact with a revoked phone channel
+    upsertContact({
+      displayName: "Guardian",
+      role: "guardian",
+      channels: [
+        {
+          type: "phone",
+          address: phone,
+          externalUserId: phone,
+          status: "revoked",
+        },
+      ],
+    });
+
+    const result = redeemVoiceInviteCode({
+      callerExternalUserId: phone,
+      sourceChannel: "phone",
+      code,
+    });
+
+    // Must reject — guardian channels are managed via the binding flow, not invites
+    expect(result).toEqual({ ok: false, reason: "invalid_or_expired" });
+  });
 });

package/src/__tests__/voice-scoped-grant-consumer.test.ts

@@ -44,7 +44,6 @@ mock.module("../util/logger.js", () => ({
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
     }),
-  isDebug: () => false,
   truncateForLog: (value: string) => value,
 }));