@vellumai/assistant 0.4.54 → 0.4.56

package/src/__tests__/canonical-guardian-store.test.ts

@@ -82,7 +82,7 @@ describe("canonical-guardian-store", () => {
       requestCode: "ABC123",
       toolName: "file_edit",
       inputDigest: "sha256:deadbeef",
-      expiresAt: new Date(Date.now() + 60_000).toISOString(),
+      expiresAt: Date.now() + 60_000,
     });
 
     expect(req.id).toBeTruthy();
@@ -303,9 +303,7 @@ describe("canonical-guardian-store", () => {
     expect(updated!.decidedByExternalUserId).toBe("guardian-1");
     // updatedAt should be at least as recent as the original (may be the
     // same millisecond when create+update run back-to-back in tests).
-    expect(new Date(updated!.updatedAt).getTime()).toBeGreaterThanOrEqual(
-      new Date(req.updatedAt).getTime(),
-    );
+    expect(updated!.updatedAt).toBeGreaterThanOrEqual(req.updatedAt);
   });
 
   test("returns null when updating nonexistent request", () => {
@@ -423,7 +421,7 @@ describe("canonical-guardian-store", () => {
       pendingQuestionId: "pq-456",
       questionText: "What is the gate code?",
       requestCode: "A1B2C3",
-      expiresAt: new Date(Date.now() + 30_000).toISOString(),
+      expiresAt: Date.now() + 30_000,
     });
 
     expect(req.sourceType).toBe("voice");
@@ -443,7 +441,7 @@ describe("canonical-guardian-store", () => {
       guardianPrincipalId: TEST_PRINCIPAL,
       toolName: "execute_code",
       inputDigest: "sha256:abcdef",
-      expiresAt: new Date(Date.now() + 120_000).toISOString(),
+      expiresAt: Date.now() + 120_000,
     });
 
     expect(req.sourceType).toBe("channel");
@@ -729,7 +727,7 @@ describe("canonical-guardian-store", () => {
       sourceType: "desktop",
       conversationId: "conv-scope-1",
       guardianPrincipalId: TEST_PRINCIPAL,
-      expiresAt: new Date(Date.now() - 10_000).toISOString(),
+      expiresAt: Date.now() - 10_000,
     });
 
     // Create a pending request that has not expired
@@ -738,7 +736,7 @@ describe("canonical-guardian-store", () => {
       sourceType: "desktop",
       conversationId: "conv-scope-1",
       guardianPrincipalId: TEST_PRINCIPAL,
-      expiresAt: new Date(Date.now() + 60_000).toISOString(),
+      expiresAt: Date.now() + 60_000,
     });
 
     const results = listPendingRequestsByConversationScope("conv-scope-1");
@@ -767,14 +765,14 @@ describe("canonical-guardian-store", () => {
       sourceType: "desktop",
       conversationId: "conv-bulk-1",
       guardianPrincipalId: TEST_PRINCIPAL,
-      expiresAt: new Date(Date.now() + 60_000).toISOString(),
+      expiresAt: Date.now() + 60_000,
     });
     const req2 = createCanonicalGuardianRequest({
       kind: "pending_question",
       sourceType: "channel",
       conversationId: "conv-bulk-2",
       guardianPrincipalId: TEST_PRINCIPAL,
-      expiresAt: new Date(Date.now() + 60_000).toISOString(),
+      expiresAt: Date.now() + 60_000,
     });
 
     const count = expireAllPendingCanonicalRequests();

package/src/__tests__/channel-approval-routes.test.ts

@@ -52,7 +52,7 @@ mock.module("../daemon/handlers/shared.js", () => ({
 
 import { upsertContact } from "../contacts/contact-store.js";
 import { createGuardianBinding } from "../contacts/contacts-write.js";
-import type { Session } from "../daemon/session.js";
+import type { Conversation } from "../daemon/conversation.js";
 import {
   createCanonicalGuardianDelivery,
   createCanonicalGuardianRequest,
@@ -152,10 +152,10 @@ function registerPendingInteraction(
   const mockSession = {
     handleConfirmationResponse,
     ensureActorScopedHistory: async () => {},
-  } as unknown as Session;
+  } as unknown as Conversation;
 
   pendingInteractions.register(requestId, {
-    session: mockSession,
+    conversation: mockSession,
     conversationId,
     kind: "confirmation",
     confirmationDetails: {
@@ -3125,7 +3125,7 @@ describe("NL approval routing via destination-scoped canonical requests", () =>
       conversationId: "conv-voice-nl-1",
       toolName: "shell",
       guardianPrincipalId: "test-principal-id",
-      expiresAt: new Date(Date.now() + 60_000).toISOString(),
+      expiresAt: Date.now() + 60_000,
       // guardianExternalUserId intentionally omitted
     });
 
@@ -3180,7 +3180,7 @@ describe("NL approval routing via destination-scoped canonical requests", () =>
       sourceChannel: "twilio",
       toolName: "shell",
       guardianPrincipalId: "test-principal-id",
-      expiresAt: new Date(Date.now() + 60_000).toISOString(),
+      expiresAt: Date.now() + 60_000,
     });
 
     // Delivery targets the original guardian chat, NOT the different chat

package/src/__tests__/channel-approval.test.ts

@@ -10,7 +10,7 @@ describe("parseCallbackData", () => {
   test.each([
     ["apr:req-123:approve_once", "approve_once"],
     ["apr:req-123:approve_10m", "approve_10m"],
-    ["apr:req-123:approve_thread", "approve_thread"],
+    ["apr:req-123:approve_conversation", "approve_conversation"],
     ["apr:req-123:approve_always", "approve_always"],
     ["apr:req-123:reject", "reject"],
   ] as const)('parses "%s" as action "%s"', (data, expectedAction) => {

package/src/__tests__/channel-approvals.test.ts

@@ -38,7 +38,7 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-import type { Session } from "../daemon/session.js";
+import type { Conversation } from "../daemon/conversation.js";
 import * as trustStore from "../permissions/trust-store.js";
 import type {
   ApprovalDecisionResult,
@@ -86,10 +86,10 @@ function registerPendingConfirmation(
   const mockSession = {
     handleConfirmationResponse: mock(() => {}),
     ensureActorScopedHistory: async () => {},
-  } as unknown as Session;
+  } as unknown as Conversation;
 
   pendingInteractions.register(requestId, {
-    session: mockSession,
+    conversation: mockSession,
     conversationId,
     kind: "confirmation",
     confirmationDetails: {
@@ -136,7 +136,7 @@ describe("getChannelApprovalPrompt", () => {
     expect(result!.actions.map((a) => a.id)).toEqual([
       "approve_once",
       "approve_10m",
-      "approve_thread",
+      "approve_conversation",
       "approve_always",
       "reject",
     ]);
@@ -177,7 +177,7 @@ describe("getChannelApprovalPrompt", () => {
     expect(result!.actions.map((a) => a.id)).toEqual([
       "approve_once",
       "approve_10m",
-      "approve_thread",
+      "approve_conversation",
       "approve_always",
       "reject",
     ]);
@@ -194,7 +194,7 @@ describe("getChannelApprovalPrompt", () => {
     expect(result!.actions.map((a) => a.id)).toEqual([
       "approve_once",
       "approve_10m",
-      "approve_thread",
+      "approve_conversation",
       "approve_always",
       "reject",
     ]);
@@ -304,7 +304,7 @@ describe("handleChannelDecision", () => {
     expect(result.applied).toBe(true);
     expect(result.requestId).toBe("req-1");
     expect(
-      interaction!.session.handleConfirmationResponse,
+      interaction!.conversation.handleConfirmationResponse,
     ).toHaveBeenCalledWith("req-1", "allow");
   });
 
@@ -320,7 +320,7 @@ describe("handleChannelDecision", () => {
     expect(result.applied).toBe(true);
     expect(result.requestId).toBe("req-1");
     expect(
-      interaction!.session.handleConfirmationResponse,
+      interaction!.conversation.handleConfirmationResponse,
     ).toHaveBeenCalledWith("req-1", "deny");
   });
 
@@ -339,10 +339,10 @@ describe("handleChannelDecision", () => {
     expect(result.applied).toBe(true);
     expect(result.requestId).toBe("req-newer");
     expect(
-      newerInteraction!.session.handleConfirmationResponse,
+      newerInteraction!.conversation.handleConfirmationResponse,
     ).toHaveBeenCalledWith("req-newer", "allow");
     expect(
-      olderInteraction!.session.handleConfirmationResponse,
+      olderInteraction!.conversation.handleConfirmationResponse,
     ).not.toHaveBeenCalled();
   });
 
@@ -393,7 +393,7 @@ describe("handleChannelDecision", () => {
 
     // The session is approved with "allow"
     expect(
-      interaction!.session.handleConfirmationResponse,
+      interaction!.conversation.handleConfirmationResponse,
     ).toHaveBeenCalledWith("req-1", "allow");
 
     addRuleSpy.mockRestore();
@@ -420,7 +420,7 @@ describe("handleChannelDecision", () => {
     // The decision should still be applied as a one-time approval
     expect(result.applied).toBe(true);
     expect(
-      interaction!.session.handleConfirmationResponse,
+      interaction!.conversation.handleConfirmationResponse,
     ).toHaveBeenCalledWith("req-1", "allow");
 
     addRuleSpy.mockRestore();
@@ -446,7 +446,7 @@ describe("handleChannelDecision", () => {
     // The current invocation should still be approved (one-time allow)
     expect(result.applied).toBe(true);
     expect(
-      interaction!.session.handleConfirmationResponse,
+      interaction!.conversation.handleConfirmationResponse,
     ).toHaveBeenCalledWith("req-1", "allow");
 
     addRuleSpy.mockRestore();

package/src/__tests__/channel-guardian.test.ts

@@ -1317,9 +1317,9 @@ function createMockCtx(): {
       captured = msg as ChannelVerificationSessionResponse;
     },
     broadcast: () => {},
-    clearAllSessions: () => 0,
-    getOrCreateSession: () => Promise.resolve({} as never),
-    touchSession: () => {},
+    clearAllConversations: () => 0,
+    getOrCreateConversation: () => Promise.resolve({} as never),
+    touchConversation: () => {},
   } as unknown as HandlerContext;
   return { ctx, lastResponse: () => captured };
 }

package/src/__tests__/channel-invite-transport.test.ts

@@ -7,7 +7,11 @@
  * canonical registry APIs (`createInviteAdapterRegistry`,
  * `getInviteAdapterRegistry`) that replaced the deprecated shims.
  */
-import { describe, expect, test } from "bun:test";
+import { describe, expect, mock, test } from "bun:test";
+
+mock.module("../email/feature-gate.js", () => ({
+  isEmailEnabled: () => true,
+}));
 
 import {
   type ChannelInviteAdapter,

package/src/__tests__/channel-readiness-routes.test.ts

@@ -57,6 +57,10 @@ mock.module("../email/service.js", () => ({
   }),
 }));
 
+mock.module("../email/feature-gate.js", () => ({
+  isEmailEnabled: () => true,
+}));
+
 // ---------------------------------------------------------------------------
 // Import under test
 // ---------------------------------------------------------------------------

package/src/__tests__/channel-reply-delivery.test.ts

@@ -61,7 +61,7 @@ mock.module("../runtime/gateway-client.js", () => ({
 }));
 
 mock.module("../memory/conversation-crud.js", () => ({
-  getConversationThreadType: () => "default",
+  getConversationType: () => "default",
   setConversationOriginChannelIfUnset: () => {},
   updateConversationContextWindow: () => {},
   deleteMessageById: () => {},

package/src/__tests__/checker.test.ts

@@ -1,5 +1,5 @@
 // Smoke command (run all security test files together):
-// bun test src/__tests__/checker.test.ts src/__tests__/trust-store.test.ts src/__tests__/session-skill-tools.test.ts src/__tests__/skill-script-runner-host.test.ts
+// bun test src/__tests__/checker.test.ts src/__tests__/trust-store.test.ts src/__tests__/conversation-skill-tools.test.ts src/__tests__/skill-script-runner-host.test.ts
 
 import {
   mkdirSync,

package/src/__tests__/claude-code-skill-regression.test.ts

@@ -29,7 +29,28 @@ mock.module("../util/logger.js", () => ({
 mock.module("../config/loader.js", () => ({
   getConfig: () => ({
     ui: {},
+    services: {
+      inference: {
+        mode: "your-own",
+        provider: "anthropic",
+        model: "claude-opus-4-6",
+      },
+      "image-generation": {
+        mode: "your-own",
+        provider: "gemini",
+        model: "gemini-2.5-flash-image",
+      },
+      "web-search": { mode: "your-own", provider: "anthropic-native" },
+    },
   }),
+  loadConfig: () => ({}),
+  loadRawConfig: () => ({}),
+  saveConfig: () => {},
+  saveRawConfig: () => {},
+  invalidateConfigCache: () => {},
+  getNestedValue: () => undefined,
+  setNestedValue: () => {},
+  syncConfigToLockfile: () => {},
 }));
 
 mock.module("../security/secure-keys.js", () => ({
@@ -52,6 +73,11 @@ const SKILL_DIR = path.resolve(
   "../config/bundled-skills/claude-code",
 );
 
+const SHARED_DIR = path.resolve(
+  import.meta.dirname ?? __dirname,
+  "../config/bundled-skills/_shared",
+);
+
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
@@ -121,7 +147,7 @@ describe("Claude Code skill migration regression", () => {
 
     const input = { prompt: "hello" };
     const ctx = {
-      sessionId: "test",
+      conversationId: "test",
       workingDir: "/tmp",
       onOutput: () => {},
     };
@@ -136,3 +162,43 @@ describe("Claude Code skill migration regression", () => {
     spy.mockRestore();
   });
 });
+
+// ---------------------------------------------------------------------------
+// Bundled skill shared guidance — CES tools instead of token-reveal
+// ---------------------------------------------------------------------------
+
+describe("CLI_RETRIEVAL_PATTERN.md CES guidance", () => {
+  const patternPath = path.join(SHARED_DIR, "CLI_RETRIEVAL_PATTERN.md");
+  const content = fs.readFileSync(patternPath, "utf-8");
+
+  test("teaches handle discovery via assistant credentials list", () => {
+    expect(content).toContain("assistant credentials list");
+  });
+
+  test("teaches handle discovery via assistant oauth connections list", () => {
+    expect(content).toContain("assistant oauth connections list");
+  });
+
+  test("teaches make_authenticated_request CES tool", () => {
+    expect(content).toContain("make_authenticated_request");
+  });
+
+  test("teaches run_authenticated_command CES tool", () => {
+    expect(content).toContain("run_authenticated_command");
+  });
+
+  test("warns that host_bash is outside CES secrecy boundary", () => {
+    expect(content).toContain("outside the CES secrecy boundary");
+  });
+
+  // -- Deprecated patterns must NOT appear --
+
+  test("does not teach proxied bash with credential_ids", () => {
+    expect(content).not.toContain("credential_ids");
+    expect(content).not.toContain("network_mode: proxied");
+  });
+
+  test("does not teach oauth connections token for raw token extraction", () => {
+    expect(content).not.toContain("oauth connections token");
+  });
+});

package/src/__tests__/claude-code-tool-profiles.test.ts

@@ -47,7 +47,7 @@ import type { ToolContext } from "../tools/types.js";
 
 function makeContext(overrides?: Partial<ToolContext>): ToolContext {
   return {
-    sessionId: "test-session",
+    conversationId: "test-session",
     workingDir: "/tmp/test",
     trustClass: "guardian",
     onOutput: () => {},

package/src/__tests__/clipboard.test.ts

@@ -2,32 +2,32 @@ import { describe, expect, test } from "bun:test";
 
 import {
   extractLastCodeBlock,
-  formatSessionForExport,
+  formatConversationForExport,
 } from "../util/clipboard.js";
 
-describe("formatSessionForExport", () => {
+describe("formatConversationForExport", () => {
   test("formats user and assistant messages", () => {
     const messages = [
       { role: "user", text: "Hello" },
       { role: "assistant", text: "Hi there!" },
     ];
-    expect(formatSessionForExport(messages)).toBe(
+    expect(formatConversationForExport(messages)).toBe(
       "you> Hello\n\nassistant> Hi there!",
     );
   });
 
   test("handles a single message", () => {
     const messages = [{ role: "user", text: "Just me" }];
-    expect(formatSessionForExport(messages)).toBe("you> Just me");
+    expect(formatConversationForExport(messages)).toBe("you> Just me");
   });
 
   test("handles empty messages array", () => {
-    expect(formatSessionForExport([])).toBe("");
+    expect(formatConversationForExport([])).toBe("");
   });
 
   test("preserves multiline message text", () => {
     const messages = [{ role: "assistant", text: "Line 1\nLine 2\nLine 3" }];
-    expect(formatSessionForExport(messages)).toBe(
+    expect(formatConversationForExport(messages)).toBe(
       "assistant> Line 1\nLine 2\nLine 3",
     );
   });

package/src/__tests__/commit-guarantee.test.ts

@@ -89,7 +89,7 @@ describe("Commit guarantees", () => {
       //   2. Post-processing (resolveAssistantAttachments) throws
       //   3. Turn-boundary commit must still happen in finally block
 
-      const sessionId = "sess_post_processing_error";
+      const conversationId = "sess_post_processing_error";
       const service = getWorkspaceGitService(testDir);
       await service.ensureInitialized();
 
@@ -114,7 +114,7 @@ describe("Commit guarantees", () => {
         // Step 3: Turn-boundary commit in finally block — the key guarantee
         if (turnStarted) {
           turnCount++;
-          await commitTurnChanges(testDir, sessionId, turnCount);
+          await commitTurnChanges(testDir, conversationId, turnCount);
         }
       }
 
@@ -124,7 +124,7 @@ describe("Commit guarantees", () => {
 
       const msg = lastCommitMessage(testDir);
       expect(msg).toContain("Turn:");
-      expect(msg).toContain("Session: sess_post_processing_error");
+      expect(msg).toContain("Conversation: sess_post_processing_error");
       expect(msg).toContain("Turn: 1");
       expect(msg).toContain("Files: 2 changed");
     });
@@ -161,7 +161,7 @@ describe("Commit guarantees", () => {
     test("commits workspace changes when user cancels mid-turn", async () => {
       // When the user cancels, the agent loop may have already modified files.
       // The finally-block commit must still run.
-      const sessionId = "sess_cancelled";
+      const conversationId = "sess_cancelled";
       const service = getWorkspaceGitService(testDir);
       await service.ensureInitialized();
 
@@ -182,7 +182,7 @@ describe("Commit guarantees", () => {
       } finally {
         if (turnStarted) {
           turnCount++;
-          await commitTurnChanges(testDir, sessionId, turnCount);
+          await commitTurnChanges(testDir, conversationId, turnCount);
         }
       }
 
@@ -195,7 +195,7 @@ describe("Commit guarantees", () => {
     test("commits across multiple turns with intermittent errors", async () => {
       // Verify commit guarantees hold across multiple turns where some
       // succeed normally and others have post-processing errors.
-      const sessionId = "sess_mixed";
+      const conversationId = "sess_mixed";
       const service = getWorkspaceGitService(testDir);
       await service.ensureInitialized();
 
@@ -211,7 +211,7 @@ describe("Commit guarantees", () => {
         } finally {
           if (turnStarted) {
             turnCount++;
-            await commitTurnChanges(testDir, sessionId, turnCount);
+            await commitTurnChanges(testDir, conversationId, turnCount);
           }
         }
       }
@@ -228,7 +228,7 @@ describe("Commit guarantees", () => {
         } finally {
           if (turnStarted) {
             turnCount++;
-            await commitTurnChanges(testDir, sessionId, turnCount);
+            await commitTurnChanges(testDir, conversationId, turnCount);
           }
         }
       }
@@ -242,7 +242,7 @@ describe("Commit guarantees", () => {
         } finally {
           if (turnStarted) {
             turnCount++;
-            await commitTurnChanges(testDir, sessionId, turnCount);
+            await commitTurnChanges(testDir, conversationId, turnCount);
           }
         }
       }

package/src/__tests__/commit-message-enrichment-service.test.ts

@@ -1,5 +1,11 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  rmSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
@@ -50,7 +56,7 @@ describe("CommitEnrichmentService", () => {
     return {
       workspaceDir: testDir,
       trigger: "turn",
-      sessionId: "sess_test",
+      conversationId: "sess_test",
       turnNumber: 1,
       changedFiles: ["file.txt"],
       timestampMs: Date.now(),
@@ -59,9 +65,34 @@ describe("CommitEnrichmentService", () => {
   }
 
   async function createCommit(): Promise<string> {
-    writeFileSync(join(testDir, `file-${Date.now()}.txt`), "content");
-    await gitService.commitChanges("test commit");
-    return await gitService.getHeadHash();
+    const filename = `file-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`;
+    writeFileSync(join(testDir, filename), "content");
+    // Use execFileSync directly for test setup commits to avoid async
+    // timing issues that can leave stale index.lock files on loaded CI runners.
+    const lockPath = join(testDir, ".git", "index.lock");
+    try {
+      unlinkSync(lockPath);
+    } catch {
+      /* no lock to clean */
+    }
+    execFileSync("git", ["add", "-A"], { cwd: testDir });
+    execFileSync(
+      "git",
+      [
+        "-c",
+        "core.hooksPath=/dev/null",
+        "commit",
+        "--no-verify",
+        "-m",
+        "test commit",
+        "--allow-empty",
+      ],
+      { cwd: testDir },
+    );
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: testDir,
+      encoding: "utf-8",
+    }).trim();
   }
 
   async function waitForDrain(
@@ -111,7 +142,7 @@ describe("CommitEnrichmentService", () => {
     const note = JSON.parse(noteContent);
     expect(note.enriched).toBe(true);
     expect(note.trigger).toBe("turn");
-    expect(note.sessionId).toBe("sess_test");
+    expect(note.conversationId).toBe("sess_test");
     expect(note.turnNumber).toBe(1);
     expect(note.filesChanged).toBe(1);
     expect(service._getSucceededCount()).toBe(1);

package/src/__tests__/computer-use-tools.test.ts

@@ -31,7 +31,6 @@ function schema(tool: {
 
 const ctx: ToolContext = {
   workingDir: "/tmp",
-  sessionId: "test-session",
   conversationId: "test-conversation",
   trustClass: "guardian",
 };

package/src/__tests__/config-loader-backfill.test.ts

@@ -230,8 +230,9 @@ describe("config loader backfill", () => {
 
   test("preserves existing user-defined values during backfill", () => {
     writeConfig({
-      provider: "openai",
-      model: "gpt-4",
+      services: {
+        inference: { provider: "openai", model: "gpt-4" },
+      },
       telegram: { botUsername: "mybot", timeoutMs: 30_000 },
       whatsapp: { phoneNumber: "+1234567890" },
     });
@@ -240,8 +241,9 @@ describe("config loader backfill", () => {
 
     const raw = readConfig();
     // User values preserved
-    expect(raw.provider).toBe("openai");
-    expect(raw.model).toBe("gpt-4");
+    const services = raw.services as Record<string, Record<string, unknown>>;
+    expect(services.inference.provider).toBe("openai");
+    expect(services.inference.model).toBe("gpt-4");
     expect((raw.telegram as Record<string, unknown>).botUsername).toBe("mybot");
     expect((raw.telegram as Record<string, unknown>).timeoutMs).toBe(30_000);
     expect((raw.whatsapp as Record<string, unknown>).phoneNumber).toBe(