@vellumai/assistant 0.4.54 → 0.4.56

package/src/__tests__/approval-routes-http.test.ts

@@ -9,8 +9,8 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
+import type { Conversation } from "../daemon/conversation.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
-import type { Session } from "../daemon/session.js";
 
 const testDir = realpathSync(
   mkdtempSync(join(tmpdir(), "approval-routes-http-test-")),
@@ -46,6 +46,19 @@ mock.module("../config/loader.js", () => ({
     secretDetection: { enabled: false },
     sandbox: { enabled: false },
     contextWindow: { maxInputTokens: 200000 },
+    services: {
+      inference: {
+        mode: "your-own",
+        provider: "anthropic",
+        model: "claude-opus-4-6",
+      },
+      "image-generation": {
+        mode: "your-own",
+        provider: "gemini",
+        model: "gemini-2.5-flash-image",
+      },
+      "web-search": { mode: "your-own", provider: "anthropic-native" },
+    },
   }),
 }));
 
@@ -82,13 +95,13 @@ import * as pendingInteractions from "../runtime/pending-interactions.js";
 initializeDb();
 
 // ---------------------------------------------------------------------------
-// Session helpers
+// Conversation helpers
 // ---------------------------------------------------------------------------
 
 function makeIdleSession(opts?: {
   onConfirmation?: (requestId: string, decision: string) => void;
   onSecret?: (requestId: string, value?: string, delivery?: string) => void;
-}): Session {
+}): Conversation {
   let processing = false;
   return {
     isProcessing: () => processing,
@@ -127,7 +140,7 @@ function makeIdleSession(opts?: {
       onEvent: (msg: ServerMessage) => void,
     ) => {
       onEvent({ type: "assistant_text_delta", text: "Hello!" });
-      onEvent({ type: "message_complete", sessionId: "test-session" });
+      onEvent({ type: "message_complete", conversationId: "test-session" });
       processing = false;
     },
     handleConfirmationResponse: (requestId: string, decision: string) => {
@@ -140,18 +153,18 @@ function makeIdleSession(opts?: {
     ) => {
       opts?.onSecret?.(requestId, value, delivery);
     },
-  } as unknown as Session;
+  } as unknown as Conversation;
 }
 
 /**
- * Session whose agent loop emits a confirmation_request, so the hub
+ * Conversation whose agent loop emits a confirmation_request, so the hub
  * publisher registers a pending interaction automatically.
  */
 function makeConfirmationEmittingSession(opts?: {
   onConfirmation?: (requestId: string, decision: string) => void;
   confirmRequestId?: string;
   toolName?: string;
-}): Session {
+}): Conversation {
   let processing = false;
   const reqId = opts?.confirmRequestId ?? "confirm-req-1";
   const tool = opts?.toolName ?? "shell_command";
@@ -202,7 +215,7 @@ function makeConfirmationEmittingSession(opts?: {
         allowlistOptions: [
           { label: "Allow ls", description: "Allow ls command", pattern: "ls" },
         ],
-        scopeOptions: [{ label: "This session", scope: "session" }],
+        scopeOptions: [{ label: "This conversation", scope: "session" }],
         persistentDecisionsAllowed: true,
       });
       // Hang to simulate waiting for decision
@@ -212,7 +225,7 @@ function makeConfirmationEmittingSession(opts?: {
       opts?.onConfirmation?.(requestId, decision);
     },
     handleSecretResponse: () => {},
-  } as unknown as Session;
+  } as unknown as Conversation;
 }
 
 // ---------------------------------------------------------------------------
@@ -245,13 +258,15 @@ describe("standalone approval endpoints — HTTP layer", () => {
     }
   });
 
-  async function startServer(sessionFactory: () => Session): Promise<void> {
+  async function startServer(
+    conversationFactory: () => Conversation,
+  ): Promise<void> {
     port = 20000 + Math.floor(Math.random() * 1000);
     server = new RuntimeHttpServer({
       port,
       bearerToken: TEST_TOKEN,
       sendMessageDeps: {
-        getOrCreateSession: async () => sessionFactory(),
+        getOrCreateConversation: async () => conversationFactory(),
         assistantEventHub: eventHub,
         resolveAttachments: () => [],
       },
@@ -285,7 +300,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
 
       // Manually register a pending interaction
       pendingInteractions.register("req-abc", {
-        session,
+        conversation: session,
         conversationId: "conv-1",
         kind: "confirmation",
         confirmationDetails: {
@@ -334,7 +349,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
       await startServer(() => session);
 
       pendingInteractions.register("req-once", {
-        session,
+        conversation: session,
         conversationId: "conv-1",
         kind: "confirmation",
       });
@@ -406,7 +421,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
       await startServer(() => session);
 
       pendingInteractions.register("secret-req-1", {
-        session,
+        conversation: session,
         conversationId: "conv-1",
         kind: "secret",
       });
@@ -582,7 +597,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
 
       // Register without confirmationDetails
       pendingInteractions.register("req-no-details", {
-        session,
+        conversation: session,
         conversationId: "conv-1",
         kind: "secret",
       });
@@ -608,7 +623,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
       await startServer(() => session);
 
       pendingInteractions.register("req-no-persist", {
-        session,
+        conversation: session,
         conversationId: "conv-1",
         kind: "confirmation",
         confirmationDetails: {
@@ -618,7 +633,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
           allowlistOptions: [
             { label: "Allow", description: "test", pattern: "rm" },
           ],
-          scopeOptions: [{ label: "Session", scope: "session" }],
+          scopeOptions: [{ label: "Conversation", scope: "session" }],
           persistentDecisionsAllowed: false,
         },
       });
@@ -644,7 +659,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
       await startServer(() => session);
 
       pendingInteractions.register("req-bad-pattern", {
-        session,
+        conversation: session,
         conversationId: "conv-1",
         kind: "confirmation",
         confirmationDetails: {
@@ -654,7 +669,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
           allowlistOptions: [
             { label: "Allow ls", description: "test", pattern: "ls" },
           ],
-          scopeOptions: [{ label: "Session", scope: "session" }],
+          scopeOptions: [{ label: "Conversation", scope: "session" }],
         },
       });
 
@@ -683,7 +698,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
       await startServer(() => session);
 
       pendingInteractions.register("req-bad-scope", {
-        session,
+        conversation: session,
         conversationId: "conv-1",
         kind: "confirmation",
         confirmationDetails: {
@@ -693,7 +708,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
           allowlistOptions: [
             { label: "Allow ls", description: "test", pattern: "ls" },
           ],
-          scopeOptions: [{ label: "Session", scope: "session" }],
+          scopeOptions: [{ label: "Conversation", scope: "session" }],
         },
       });
 
@@ -722,7 +737,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
       await startServer(() => session);
 
       pendingInteractions.register("req-keep", {
-        session,
+        conversation: session,
         conversationId: "conv-1",
         kind: "confirmation",
         confirmationDetails: {
@@ -732,7 +747,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
           allowlistOptions: [
             { label: "Allow ls", description: "test", pattern: "ls" },
           ],
-          scopeOptions: [{ label: "Session", scope: "session" }],
+          scopeOptions: [{ label: "Conversation", scope: "session" }],
         },
       });
 
@@ -821,17 +836,17 @@ describe("standalone approval endpoints — HTTP layer", () => {
       await startServer(() => session);
 
       pendingInteractions.register("req-a", {
-        session,
+        conversation: session,
         conversationId: "conv-x",
         kind: "confirmation",
       });
       pendingInteractions.register("req-b", {
-        session,
+        conversation: session,
         conversationId: "conv-x",
         kind: "secret",
       });
       pendingInteractions.register("req-c", {
-        session,
+        conversation: session,
         conversationId: "conv-y",
         kind: "confirmation",
       });

package/src/__tests__/asset-materialize-tool.test.ts

@@ -72,7 +72,6 @@ function resetTables() {
 
 const dummyContext: ToolContext = {
   workingDir: sandboxDir,
-  sessionId: "sess-test",
   conversationId: "conv-test",
   trustClass: "guardian",
 };
@@ -350,7 +349,6 @@ describe("AssetMaterializeTool visibility policy", () => {
     const otherConv = createConversation({ title: "other-conv" });
     const context: ToolContext = {
       workingDir: sandboxDir,
-      sessionId: "sess-test",
       conversationId: otherConv.id,
       trustClass: "guardian",
     };
@@ -366,7 +364,7 @@ describe("AssetMaterializeTool visibility policy", () => {
   test("materializing from a private thread works within the same private thread", async () => {
     const privateConv = createConversation({
       title: "private-conv",
-      threadType: "private",
+      conversationType: "private",
     });
     const base64Content = Buffer.from("private content").toString("base64");
     const attachment = uploadAttachment(
@@ -380,7 +378,6 @@ describe("AssetMaterializeTool visibility policy", () => {
     // Materialize from the same private conversation
     const context: ToolContext = {
       workingDir: sandboxDir,
-      sessionId: "sess-test",
       conversationId: privateConv.id,
       trustClass: "guardian",
     };
@@ -396,7 +393,7 @@ describe("AssetMaterializeTool visibility policy", () => {
   test("materializing from a private thread is REJECTED from a different conversation", async () => {
     const privateConv = createConversation({
       title: "private-conv",
-      threadType: "private",
+      conversationType: "private",
     });
     const base64Content = Buffer.from("private content").toString("base64");
     const attachment = uploadAttachment(
@@ -411,7 +408,6 @@ describe("AssetMaterializeTool visibility policy", () => {
     const otherConv = createConversation({ title: "other-conv" });
     const context: ToolContext = {
       workingDir: sandboxDir,
-      sessionId: "sess-test",
       conversationId: otherConv.id,
       trustClass: "guardian",
     };
@@ -421,14 +417,14 @@ describe("AssetMaterializeTool visibility policy", () => {
       context,
     );
     expect(result.isError).toBe(true);
-    expect(result.content).toContain("private thread");
+    expect(result.content).toContain("private conversation");
     expect(result.content).toContain("cannot be accessed");
   });
 
   test("error message is user-actionable", async () => {
     const privateConv = createConversation({
       title: "private-conv",
-      threadType: "private",
+      conversationType: "private",
     });
     const base64Content = Buffer.from("private content").toString("base64");
     const attachment = uploadAttachment(
@@ -443,7 +439,6 @@ describe("AssetMaterializeTool visibility policy", () => {
     const standardConv = createConversation({ title: "standard-conv" });
     const context: ToolContext = {
       workingDir: sandboxDir,
-      sessionId: "sess-test",
       conversationId: standardConv.id,
       trustClass: "guardian",
     };
@@ -456,13 +451,13 @@ describe("AssetMaterializeTool visibility policy", () => {
     // Should mention the filename so the user knows which file
     expect(result.content).toContain("confidential.pdf");
     // Should explain how to access it
-    expect(result.content).toContain("from within the private thread");
+    expect(result.content).toContain("from within the private conversation");
   });
 
   test("materializing from a different private thread is REJECTED", async () => {
     const privateConv1 = createConversation({
       title: "private-conv-1",
-      threadType: "private",
+      conversationType: "private",
     });
     const base64Content = Buffer.from("private content").toString("base64");
     const attachment = uploadAttachment(
@@ -476,11 +471,10 @@ describe("AssetMaterializeTool visibility policy", () => {
     // Attempt from a different private conversation
     const privateConv2 = createConversation({
       title: "private-conv-2",
-      threadType: "private",
+      conversationType: "private",
     });
     const context: ToolContext = {
       workingDir: sandboxDir,
-      sessionId: "sess-test",
       conversationId: privateConv2.id,
       trustClass: "guardian",
     };
@@ -490,13 +484,13 @@ describe("AssetMaterializeTool visibility policy", () => {
       context,
     );
     expect(result.isError).toBe(true);
-    expect(result.content).toContain("private thread");
+    expect(result.content).toContain("private conversation");
   });
 
   test("attachment linked to both private and standard threads can be materialized from anywhere", async () => {
     const privateConv = createConversation({
       title: "private-conv",
-      threadType: "private",
+      conversationType: "private",
     });
     const standardConv = createConversation({ title: "standard-conv" });
     const base64Content = Buffer.from("shared content").toString("base64");
@@ -515,7 +509,6 @@ describe("AssetMaterializeTool visibility policy", () => {
     const otherConv = createConversation({ title: "other-conv" });
     const context: ToolContext = {
       workingDir: sandboxDir,
-      sessionId: "sess-test",
       conversationId: otherConv.id,
       trustClass: "guardian",
     };

package/src/__tests__/asset-search-tool.test.ts

@@ -97,7 +97,6 @@ function seedAttachments() {
 
 const dummyContext: ToolContext = {
   workingDir: "/tmp",
-  sessionId: "sess-test",
   conversationId: "conv-test",
   trustClass: "guardian",
 };
@@ -417,7 +416,6 @@ describe("AssetSearchTool visibility policy", () => {
     const otherConv = createConversation({ title: "other-conv" });
     const context: ToolContext = {
       workingDir: "/tmp",
-      sessionId: "sess-test",
       conversationId: otherConv.id,
       trustClass: "guardian",
     };
@@ -430,7 +428,7 @@ describe("AssetSearchTool visibility policy", () => {
   test("attachments from private threads are visible within the same private thread", async () => {
     const privateConv = createConversation({
       title: "private-conv",
-      threadType: "private",
+      conversationType: "private",
     });
     const attachment = uploadAttachment("secret.png", "image/png", "AAAA");
     const msg = await addMessage(privateConv.id, "user", "private message");
@@ -439,7 +437,6 @@ describe("AssetSearchTool visibility policy", () => {
     // Search from the same private conversation
     const context: ToolContext = {
       workingDir: "/tmp",
-      sessionId: "sess-test",
       conversationId: privateConv.id,
       trustClass: "guardian",
     };
@@ -452,7 +449,7 @@ describe("AssetSearchTool visibility policy", () => {
   test("attachments from private threads are NOT visible from a different conversation", async () => {
     const privateConv = createConversation({
       title: "private-conv",
-      threadType: "private",
+      conversationType: "private",
     });
     const attachment = uploadAttachment("secret.png", "image/png", "AAAA");
     const msg = await addMessage(privateConv.id, "user", "private message");
@@ -461,11 +458,10 @@ describe("AssetSearchTool visibility policy", () => {
     // Search from a different private conversation
     const otherPrivateConv = createConversation({
       title: "other-private",
-      threadType: "private",
+      conversationType: "private",
     });
     const context: ToolContext = {
       workingDir: "/tmp",
-      sessionId: "sess-test",
       conversationId: otherPrivateConv.id,
       trustClass: "guardian",
     };
@@ -478,7 +474,7 @@ describe("AssetSearchTool visibility policy", () => {
   test("attachments from private threads are NOT visible from standard threads", async () => {
     const privateConv = createConversation({
       title: "private-conv",
-      threadType: "private",
+      conversationType: "private",
     });
     const attachment = uploadAttachment("secret.png", "image/png", "AAAA");
     const msg = await addMessage(privateConv.id, "user", "private message");
@@ -488,7 +484,6 @@ describe("AssetSearchTool visibility policy", () => {
     const standardConv = createConversation({ title: "standard-conv" });
     const context: ToolContext = {
       workingDir: "/tmp",
-      sessionId: "sess-test",
       conversationId: standardConv.id,
       trustClass: "guardian",
     };
@@ -501,7 +496,7 @@ describe("AssetSearchTool visibility policy", () => {
   test("attachment linked to both private and standard threads is visible everywhere", async () => {
     const privateConv = createConversation({
       title: "private-conv",
-      threadType: "private",
+      conversationType: "private",
     });
     const standardConv = createConversation({ title: "standard-conv" });
     const attachment = uploadAttachment("shared.png", "image/png", "AAAA");
@@ -515,7 +510,6 @@ describe("AssetSearchTool visibility policy", () => {
     const otherConv = createConversation({ title: "other-conv" });
     const context: ToolContext = {
       workingDir: "/tmp",
-      sessionId: "sess-test",
       conversationId: otherConv.id,
       trustClass: "guardian",
     };
@@ -531,7 +525,6 @@ describe("AssetSearchTool visibility policy", () => {
     const conv = createConversation({ title: "any-conv" });
     const context: ToolContext = {
       workingDir: "/tmp",
-      sessionId: "sess-test",
       conversationId: conv.id,
       trustClass: "guardian",
     };

package/src/__tests__/assistant-attachments.test.ts

@@ -192,6 +192,33 @@ describe("validateDrafts", () => {
     expect(result.accepted).toHaveLength(0);
     expect(result.warnings).toHaveLength(0);
   });
+
+  test("accepts a 25 MB attachment (under 50 MB limit)", () => {
+    const drafts = [
+      makeDraft({
+        filename: "video.mov",
+        sizeBytes: 25 * 1024 * 1024,
+      }),
+    ];
+    const result = validateDrafts(drafts);
+    expect(result.accepted).toHaveLength(1);
+    expect(result.warnings).toHaveLength(0);
+  });
+
+  test("rejects a 51 MB attachment with warning mentioning 50.0 MB limit", () => {
+    const drafts = [
+      makeDraft({
+        filename: "huge.mov",
+        sizeBytes: 51 * 1024 * 1024,
+      }),
+    ];
+    const result = validateDrafts(drafts);
+    expect(result.accepted).toHaveLength(0);
+    expect(result.warnings).toHaveLength(1);
+    expect(result.warnings[0]).toContain("huge.mov");
+    expect(result.warnings[0]).toContain("50.0 MB");
+    expect(result.warnings[0]).toContain("limit");
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/__tests__/assistant-event-hub.test.ts

@@ -7,9 +7,13 @@ function makeEvent(overrides: Partial<AssistantEvent> = {}): AssistantEvent {
   return {
     id: "evt_test",
     assistantId: "ast_1",
-    sessionId: "sess_1",
+    conversationId: "sess_1",
     emittedAt: "2026-02-18T00:00:00.000Z",
-    message: { type: "assistant_text_delta", sessionId: "sess_1", text: "hi" },
+    message: {
+      type: "assistant_text_delta",
+      conversationId: "sess_1",
+      text: "hi",
+    },
     ...overrides,
   };
 }
@@ -61,25 +65,25 @@ describe("AssistantEventHub — fanout", () => {
     expect(received).toHaveLength(0);
   });
 
-  test("sessionId filter further restricts delivery", async () => {
+  test("conversationId filter further restricts delivery", async () => {
     const hub = new AssistantEventHub();
     const receivedA: AssistantEvent[] = [];
     const receivedB: AssistantEvent[] = [];
 
-    hub.subscribe({ assistantId: "ast_1", sessionId: "sess_A" }, (e) => {
+    hub.subscribe({ assistantId: "ast_1", conversationId: "sess_A" }, (e) => {
       receivedA.push(e);
     });
-    hub.subscribe({ assistantId: "ast_1", sessionId: "sess_B" }, (e) => {
+    hub.subscribe({ assistantId: "ast_1", conversationId: "sess_B" }, (e) => {
       receivedB.push(e);
     });
 
-    await hub.publish(makeEvent({ sessionId: "sess_A" }));
+    await hub.publish(makeEvent({ conversationId: "sess_A" }));
 
     expect(receivedA).toHaveLength(1);
     expect(receivedB).toHaveLength(0);
   });
 
-  test("subscriber without sessionId filter receives all sessions for that assistant", async () => {
+  test("subscriber without conversationId filter receives all sessions for that assistant", async () => {
     const hub = new AssistantEventHub();
     const received: AssistantEvent[] = [];
 
@@ -87,9 +91,9 @@ describe("AssistantEventHub — fanout", () => {
       received.push(e);
     });
 
-    await hub.publish(makeEvent({ sessionId: "sess_A" }));
-    await hub.publish(makeEvent({ sessionId: "sess_B" }));
-    await hub.publish(makeEvent({ sessionId: undefined }));
+    await hub.publish(makeEvent({ conversationId: "sess_A" }));
+    await hub.publish(makeEvent({ conversationId: "sess_B" }));
+    await hub.publish(makeEvent({ conversationId: undefined }));
 
     expect(received).toHaveLength(3);
   });

package/src/__tests__/assistant-event.test.ts

@@ -16,31 +16,31 @@ describe("AssistantEvent shape", () => {
       emittedAt: "2026-02-18T21:20:00.000Z",
       message: {
         type: "assistant_text_delta",
-        sessionId: "conv_456",
+        conversationId: "conv_456",
         text: "Working on it...",
       },
     };
 
     expect(event.id).toBe("evt_001");
     expect(event.assistantId).toBe("ast_123");
-    expect(event.sessionId).toBeUndefined();
+    expect(event.conversationId).toBeUndefined();
     expect(event.emittedAt).toBe("2026-02-18T21:20:00.000Z");
     expect(event.message.type).toBe("assistant_text_delta");
   });
 
-  test("accepts a full event with sessionId", () => {
+  test("accepts a full event with conversationId", () => {
     const event: AssistantEvent = {
       id: "evt_002",
       assistantId: "ast_123",
-      sessionId: "conv_456",
+      conversationId: "conv_456",
       emittedAt: "2026-02-18T21:20:00.000Z",
       message: {
         type: "message_complete",
-        sessionId: "conv_456",
+        conversationId: "conv_456",
       },
     };
 
-    expect(event.sessionId).toBe("conv_456");
+    expect(event.conversationId).toBe("conv_456");
     expect(event.message.type).toBe("message_complete");
   });
 });
@@ -51,11 +51,11 @@ describe("formatSseFrame", () => {
   const baseEvent: AssistantEvent = {
     id: "evt_003",
     assistantId: "ast_abc",
-    sessionId: "sess_xyz",
+    conversationId: "sess_xyz",
     emittedAt: "2026-02-18T00:00:00.000Z",
     message: {
       type: "assistant_text_delta",
-      sessionId: "sess_xyz",
+      conversationId: "sess_xyz",
       text: "hello",
     },
   };
@@ -81,7 +81,7 @@ describe("formatSseFrame", () => {
 
     expect(parsed.id).toBe(baseEvent.id);
     expect(parsed.assistantId).toBe(baseEvent.assistantId);
-    expect(parsed.sessionId).toBe(baseEvent.sessionId);
+    expect(parsed.conversationId).toBe(baseEvent.conversationId);
     expect(parsed.emittedAt).toBe(baseEvent.emittedAt);
     expect(parsed.message.type).toBe("assistant_text_delta");
   });

package/src/__tests__/assistant-feature-flag-guardrails.test.ts

@@ -244,8 +244,13 @@ describe("assistant feature flag indirect key coverage guard", () => {
       if (colonIdx === -1) continue;
       const filePath = line.slice(0, colonIdx);
 
-      // Skip test files
+      // Skip test files and persisted-data migration files (they reference retired flag keys by design)
       if (isTestFile(filePath)) continue;
+      if (
+        filePath.includes("/workspace/migrations/") ||
+        filePath.includes("/memory/migrations/")
+      )
+        continue;
 
       // Extract all key occurrences from this line
       const content = line.slice(colonIdx + 1);