@vellumai/assistant 0.4.56 → 0.4.57

package/src/__tests__/gateway-only-enforcement.test.ts

@@ -58,7 +58,7 @@ mock.module("../config/loader.js", () => ({
     model: "test",
     provider: "test",
     memory: { enabled: false },
-    rateLimit: { maxRequestsPerMinute: 0, maxTokensPerSession: 0 },
+    rateLimit: { maxRequestsPerMinute: 0 },
     secretDetection: { enabled: false },
     calls: {
       enabled: true,
@@ -80,7 +80,7 @@ mock.module("../config/loader.js", () => ({
     model: "test",
     provider: "test",
     memory: { enabled: false },
-    rateLimit: { maxRequestsPerMinute: 0, maxTokensPerSession: 0 },
+    rateLimit: { maxRequestsPerMinute: 0 },
     secretDetection: { enabled: false },
     ingress: {
       publicBaseUrl: "https://test.example.com",

package/src/__tests__/gateway-only-guard.test.ts

@@ -22,6 +22,7 @@ const ALLOWLIST = new Set([
   // Matched by prefix check below: gateway/
 
   // --- Intentional local daemon-control paths ---
+  "assistant/src/cli/commands/conversations.ts", // CLI wipe talks to runtime directly
   "clients/shared/Network/DaemonClient.swift",
   "clients/macos/vellum-assistant/App/AppDelegate.swift",
   "clients/macos/vellum-assistant/Features/Settings/SettingsConnectTab.swift",

package/src/__tests__/gemini-image-service.test.ts

@@ -111,7 +111,7 @@ describe("generateImage", () => {
     expect(result.images).toHaveLength(1);
     expect(result.images[0].mimeType).toBe("image/png");
     expect(result.images[0].dataBase64).toBe("abc123");
-    expect(result.resolvedModel).toBe("gemini-2.5-flash-image");
+    expect(result.resolvedModel).toBe("gemini-3.1-flash-image-preview");
   });
 
   test("generate mode collects text commentary from response", async () => {
@@ -168,7 +168,7 @@ describe("generateImage", () => {
 
     expect(lastGenerateParams).not.toBeNull();
     expect((lastGenerateParams as Record<string, unknown>).model).toBe(
-      "gemini-2.5-flash-image",
+      "gemini-3.1-flash-image-preview",
     );
   });
 
@@ -180,12 +180,12 @@ describe("generateImage", () => {
       {
         prompt: "test",
         mode: "generate",
-        model: "gemini-3-pro-image",
+        model: "gemini-3-pro-image-preview",
       },
     );
 
     expect((lastGenerateParams as Record<string, unknown>).model).toBe(
-      "gemini-3-pro-image",
+      "gemini-3-pro-image-preview",
     );
   });
 

package/src/__tests__/gemini-provider.test.ts

@@ -739,17 +739,14 @@ describe("GeminiProvider", () => {
     expect(lastConstructorOpts).toEqual({ apiKey: "test-key" });
   });
 
-  test("sets vertexai mode with httpOptions.baseUrl when managedBaseUrl is provided", () => {
+  test("sets httpOptions.baseUrl when managedBaseUrl is provided", () => {
     new GeminiProvider("managed-key", "gemini-3-flash", {
-      managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/vertex",
+      managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
     });
     expect(lastConstructorOpts).toEqual({
-      vertexai: true,
-      project: "proxy",
-      location: "us-central1",
+      apiKey: "managed-key",
       httpOptions: {
-        baseUrl: "https://platform.example.com/v1/runtime-proxy/vertex",
-        headers: { Authorization: "Bearer managed-key" },
+        baseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
       },
     });
   });
@@ -759,7 +756,7 @@ describe("GeminiProvider", () => {
       "managed-key",
       "gemini-3-flash",
       {
-        managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/vertex",
+        managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
       },
     );
 
@@ -784,7 +781,7 @@ describe("GeminiProvider", () => {
       "managed-key",
       "gemini-3-flash",
       {
-        managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/vertex",
+        managedBaseUrl: "https://platform.example.com/v1/runtime-proxy/gemini",
       },
     );
 

package/src/__tests__/guardian-binding-drift-heal.test.ts

@@ -0,0 +1,128 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+const testDir = mkdtempSync(
+  join(tmpdir(), "guardian-binding-drift-heal-test-"),
+);
+
+mock.module("../util/platform.js", () => ({
+  getDataDir: () => testDir,
+  isMacOS: () => process.platform === "darwin",
+  isLinux: () => process.platform === "linux",
+  isWindows: () => process.platform === "win32",
+  getPidPath: () => join(testDir, "test.pid"),
+  getDbPath: () => join(testDir, "test.db"),
+  getLogPath: () => join(testDir, "test.log"),
+  ensureDataDir: () => {},
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+import { findGuardianForChannel } from "../contacts/contact-store.js";
+import { createGuardianBinding } from "../contacts/contacts-write.js";
+import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { healGuardianBindingDrift } from "../runtime/guardian-vellum-migration.js";
+
+initializeDb();
+
+function resetTables(): void {
+  const db = getDb();
+  db.run("DELETE FROM contact_channels");
+  db.run("DELETE FROM contacts");
+}
+
+describe("healGuardianBindingDrift", () => {
+  beforeEach(() => {
+    resetTables();
+  });
+
+  afterAll(() => {
+    resetDb();
+    try {
+      rmSync(testDir, { recursive: true });
+    } catch {
+      // best-effort cleanup
+    }
+  });
+
+  test("heals drift when both principals have vellum-principal- prefix", () => {
+    // Simulate DB reset: new guardian binding with a different UUID
+    createGuardianBinding({
+      channel: "vellum",
+      guardianExternalUserId: "vellum-principal-new-uuid",
+      guardianDeliveryChatId: "local",
+      guardianPrincipalId: "vellum-principal-new-uuid",
+      verifiedVia: "startup-migration",
+    });
+
+    // Client arrives with the old JWT principal
+    const healed = healGuardianBindingDrift("vellum-principal-old-uuid");
+    expect(healed).toBe(true);
+
+    // Guardian binding now matches the old JWT
+    const guardian = findGuardianForChannel("vellum");
+    expect(guardian).not.toBeNull();
+    expect(guardian!.contact.principalId).toBe("vellum-principal-old-uuid");
+    expect(guardian!.channel.externalUserId).toBe("vellum-principal-old-uuid");
+  });
+
+  test("no-op when principals already match", () => {
+    createGuardianBinding({
+      channel: "vellum",
+      guardianExternalUserId: "vellum-principal-same",
+      guardianDeliveryChatId: "local",
+      guardianPrincipalId: "vellum-principal-same",
+      verifiedVia: "startup-migration",
+    });
+
+    const healed = healGuardianBindingDrift("vellum-principal-same");
+    expect(healed).toBe(false);
+  });
+
+  test("refuses to heal when incoming principal lacks vellum-principal- prefix", () => {
+    createGuardianBinding({
+      channel: "vellum",
+      guardianExternalUserId: "vellum-principal-aaa",
+      guardianDeliveryChatId: "local",
+      guardianPrincipalId: "vellum-principal-aaa",
+      verifiedVia: "startup-migration",
+    });
+
+    // External/platform principal — should NOT be adopted
+    const healed = healGuardianBindingDrift("platform-user-12345");
+    expect(healed).toBe(false);
+
+    // Guardian unchanged
+    const guardian = findGuardianForChannel("vellum");
+    expect(guardian!.contact.principalId).toBe("vellum-principal-aaa");
+  });
+
+  test("refuses to heal when stored principal lacks vellum-principal- prefix", () => {
+    createGuardianBinding({
+      channel: "vellum",
+      guardianExternalUserId: "verified-phone-guardian",
+      guardianDeliveryChatId: "local",
+      guardianPrincipalId: "verified-phone-guardian",
+      verifiedVia: "challenge",
+    });
+
+    // Even with a vellum-principal- incoming, don't overwrite a real binding
+    const healed = healGuardianBindingDrift("vellum-principal-attacker");
+    expect(healed).toBe(false);
+
+    const guardian = findGuardianForChannel("vellum");
+    expect(guardian!.contact.principalId).toBe("verified-phone-guardian");
+  });
+
+  test("returns false when no guardian binding exists", () => {
+    const healed = healGuardianBindingDrift("vellum-principal-orphan");
+    expect(healed).toBe(false);
+  });
+});

package/src/__tests__/guardian-dispatch.test.ts

@@ -195,7 +195,6 @@ describe("guardian-dispatch", () => {
     expect(vellumDelivery!.destination_conversation_id).toBe("conv-vellum-1");
 
     const signalParams = emitCalls[0] as Record<string, unknown>;
-    expect(signalParams.skipVellumThread).toBeUndefined();
     expect(typeof signalParams.onConversationCreated).toBe("function");
   });
 

package/src/__tests__/host-shell-tool.test.ts

@@ -29,14 +29,14 @@ const mockConfig = {
     shellMaxTimeoutSec: 600,
     permissionTimeoutSec: 300,
   },
-  sandbox: { enabled: true },
-  rateLimit: { maxRequestsPerMinute: 0, maxTokensPerSession: 0 },
+  rateLimit: { maxRequestsPerMinute: 0 },
   secretDetection: {
     enabled: true,
     action: "warn" as const,
     entropyThreshold: 4.0,
   },
   auditLog: { retentionDays: 0 },
+  sandbox: { enabled: true },
 };
 
 // Track whether wrapCommand was ever called — host_bash must never invoke it
@@ -283,11 +283,11 @@ describe("host_bash — regression: no proxied-mode additions", () => {
     expect(schemaProps).not.toHaveProperty("credential_ids");
   });
 
-  test("schema only contains the expected properties (command, working_dir, timeout_seconds, reason)", () => {
+  test("schema only contains the expected properties (command, working_dir, timeout_seconds, activity)", () => {
     const propertyNames = Object.keys(schemaProps).sort();
     expect(propertyNames).toEqual([
+      "activity",
       "command",
-      "reason",
       "timeout_seconds",
       "working_dir",
     ]);
@@ -348,10 +348,10 @@ describe("host_bash — regression: no proxied-mode additions", () => {
     expect(definition.name).toBe("host_bash");
   });
 
-  test("required fields contains command and reason", () => {
+  test("required fields contains command and activity", () => {
     expect(
       (definition.input_schema as Record<string, unknown>).required,
-    ).toEqual(["command", "reason"]);
+    ).toEqual(["command", "activity"]);
   });
 });
 

package/src/__tests__/http-user-message-parity.test.ts

@@ -142,9 +142,9 @@ mock.module("../config/loader.js", () => ({
       "image-generation": {
         mode: "your-own",
         provider: "gemini",
-        model: "gemini-2.5-flash-image",
+        model: "gemini-3.1-flash-image-preview",
       },
-      "web-search": { mode: "your-own", provider: "anthropic-native" },
+      "web-search": { mode: "your-own", provider: "inference-provider-native" },
     },
   }),
 }));

package/src/__tests__/intent-routing.test.ts

@@ -54,7 +54,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => ({
     ui: {},
 
-    sandbox: { enabled: false, backend: "local" },
     assistantFeatureFlagValues: {},
     services: {
       inference: {
@@ -65,9 +64,9 @@ mock.module("../config/loader.js", () => ({
       "image-generation": {
         mode: "your-own",
         provider: "gemini",
-        model: "gemini-2.5-flash-image",
+        model: "gemini-3.1-flash-image-preview",
       },
-      "web-search": { mode: "your-own", provider: "anthropic-native" },
+      "web-search": { mode: "your-own", provider: "inference-provider-native" },
     },
   }),
   loadConfig: () => ({}),
@@ -105,11 +104,25 @@ const scheduleCreateDef = scheduleToolsJson.tools.find(
   (t: { name: string }) => t.name === "schedule_create",
 );
 
+// Load send_notification description from the bundled skill TOOLS.json
+const notifToolsJson = JSON.parse(
+  readFileSync(
+    join(
+      import.meta.dirname,
+      "../config/bundled-skills/notifications/TOOLS.json",
+    ),
+    "utf-8",
+  ),
+);
+const sendNotificationDef = notifToolsJson.tools.find(
+  (t: { name: string }) => t.name === "send_notification",
+);
+
 // =====================================================================
-// 1. System prompt: buildTaskScheduleReminderRoutingSection
+// 1. Routing section removed from system prompt — guidance in tool descriptions
 // =====================================================================
 
-describe("Task/Schedule routing section in system prompt", () => {
+describe("Task/Schedule routing NOT in system prompt (moved to tool descriptions)", () => {
   beforeEach(() => {
     mkdirSync(TEST_DIR, { recursive: true });
   });
@@ -120,55 +133,12 @@ describe("Task/Schedule routing section in system prompt", () => {
     }
   });
 
-  test("system prompt includes the routing section heading", () => {
+  test("system prompt does not contain the old routing section", () => {
     const prompt = buildSystemPrompt();
-    expect(prompt).toContain(
+    expect(prompt).not.toContain(
       "## Tool Routing: Tasks vs Schedules vs Notifications",
     );
   });
-
-  test("routing section lists all three tools in the summary table", () => {
-    const prompt = buildSystemPrompt();
-    expect(prompt).toContain("`task_list_add`");
-    expect(prompt).toContain("`schedule_create`");
-    expect(prompt).toContain("`send_notification`");
-  });
-
-  test("routing section warns that send_notification is immediate-only", () => {
-    const prompt = buildSystemPrompt();
-    expect(prompt).toContain("send_notification` is immediate-only");
-    expect(prompt).toContain("fires NOW");
-  });
-
-  test("routing section includes quick routing rules", () => {
-    const prompt = buildSystemPrompt();
-    expect(prompt).toContain("Quick routing rules");
-    expect(prompt).toContain("Future time, one-shot");
-    expect(prompt).toContain("Recurring pattern");
-    expect(prompt).toContain("No time, track as work");
-  });
-
-  test("routing section documents entity type routing", () => {
-    const prompt = buildSystemPrompt();
-    expect(prompt).toContain(
-      "Entity type routing: work items vs task templates",
-    );
-    expect(prompt).toContain("**Work items**");
-    expect(prompt).toContain("**Task templates**");
-  });
-
-  test("routing section references the Time-Based Actions skill", () => {
-    const prompt = buildSystemPrompt();
-    expect(prompt).toContain("Time-Based Actions");
-  });
-
-  test("routing section is present in the system prompt", () => {
-    const prompt = buildSystemPrompt();
-    const taskRoutingIdx = prompt.indexOf(
-      "## Tool Routing: Tasks vs Schedules vs Notifications",
-    );
-    expect(taskRoutingIdx).toBeGreaterThanOrEqual(0);
-  });
 });
 
 // =====================================================================
@@ -228,6 +198,18 @@ describe("schedule_create tool description", () => {
   });
 });
 
+describe("send_notification tool description", () => {
+  test("states it fires immediately with no delay", () => {
+    expect(sendNotificationDef).toBeDefined();
+    expect(sendNotificationDef.description).toContain("immediate");
+    expect(sendNotificationDef.description).toContain("no delay");
+  });
+
+  test("redirects to schedule_create for future alerts", () => {
+    expect(sendNotificationDef.description).toContain("schedule_create");
+  });
+});
+
 // =====================================================================
 // 3. Cross-tool consistency: schedule and task tools agree on routing boundaries
 // =====================================================================
@@ -244,10 +226,10 @@ describe("cross-tool routing consistency", () => {
 });
 
 // =====================================================================
-// 4. Activation hints in <available_skills> XML (replaces domain routing sections)
+// 4. Activation hints in skills catalog (replaces domain routing sections)
 // =====================================================================
 
-describe("Activation hints in available_skills XML", () => {
+describe("Activation hints in skills catalog", () => {
   beforeEach(() => {
     mkdirSync(TEST_DIR, { recursive: true });
   });
@@ -258,61 +240,31 @@ describe("Activation hints in available_skills XML", () => {
     }
   });
 
-  test("available_skills XML does NOT contain location attribute", () => {
+  test("phone-calls skill includes hints and avoid-when in catalog line", () => {
     const prompt = buildSystemPrompt();
-    const start = prompt.indexOf("<available_skills>");
-    const end = prompt.indexOf("</available_skills>");
-    expect(start).not.toBe(-1);
-    expect(end).not.toBe(-1);
-    const skillsXml = prompt.substring(start, end);
-    expect(skillsXml).not.toContain("location=");
+    const line = prompt.split("\n").find((l) => l.includes("**phone-calls**"));
+    expect(line).toBeDefined();
+    // Activation hints and avoid-when are folded into the description
+    expect(line).toContain("Twilio");
+    expect(line).toContain("Avoid: ");
+    expect(line).toContain("voice-setup");
   });
 
-  test("phone-calls bundled skill has hints and avoid-when attributes in XML", () => {
+  test("orchestration skill includes hints and avoid-when in catalog line", () => {
     const prompt = buildSystemPrompt();
-    const start = prompt.indexOf("<available_skills>");
-    const end = prompt.indexOf("</available_skills>");
-    expect(start).not.toBe(-1);
-    expect(end).not.toBe(-1);
-    const skillsXml = prompt.substring(start, end);
-    expect(skillsXml).toContain('id="phone-calls"');
-    const skillLine = skillsXml
+    const line = prompt
       .split("\n")
-      .find((l) => l.includes('id="phone-calls"'));
-    expect(skillLine).toBeDefined();
-    expect(skillLine).toContain("hints=");
-    expect(skillLine).toContain("avoid-when=");
+      .find((l) => l.includes("**orchestration**"));
+    expect(line).toBeDefined();
+    expect(line).toContain("parallel");
+    expect(line).toContain("Single-focus");
   });
 
-  test("orchestration bundled skill has hints and avoid-when attributes in XML", () => {
+  test("browser skill includes hints in catalog line", () => {
     const prompt = buildSystemPrompt();
-    const start = prompt.indexOf("<available_skills>");
-    const end = prompt.indexOf("</available_skills>");
-    expect(start).not.toBe(-1);
-    expect(end).not.toBe(-1);
-    const skillsXml = prompt.substring(start, end);
-    expect(skillsXml).toContain('id="orchestration"');
-    const skillLine = skillsXml
-      .split("\n")
-      .find((l) => l.includes('id="orchestration"'));
-    expect(skillLine).toBeDefined();
-    expect(skillLine).toContain("hints=");
-    expect(skillLine).toContain("avoid-when=");
-  });
-
-  test("browser bundled skill has hints attribute in XML", () => {
-    const prompt = buildSystemPrompt();
-    const start = prompt.indexOf("<available_skills>");
-    const end = prompt.indexOf("</available_skills>");
-    expect(start).not.toBe(-1);
-    expect(end).not.toBe(-1);
-    const skillsXml = prompt.substring(start, end);
-    expect(skillsXml).toContain('id="browser"');
-    const skillLine = skillsXml
-      .split("\n")
-      .find((l) => l.includes('id="browser"'));
-    expect(skillLine).toBeDefined();
-    expect(skillLine).toContain("hints=");
+    const line = prompt.split("\n").find((l) => l.includes("**browser**"));
+    expect(line).toBeDefined();
+    expect(line).toContain("browser_*");
   });
 
   test("domain routing sections are no longer in system prompt", () => {

package/src/__tests__/invite-routes-http.test.ts

@@ -38,6 +38,11 @@ mock.module("../telegram/bot-username.js", () => ({
   getTelegramBotUsername: () => mockTelegramBotUsername,
 }));
 
+// Mock invite instruction generator — skip LLM calls in tests.
+mock.module("../runtime/invite-instruction-generator.js", () => ({
+  generateInviteInstruction: async () => "Mock invite instruction for testing.",
+}));
+
 // Mock startInviteCall from call-domain — test env lacks Twilio credentials.
 let mockStartInviteCallResult:
   | { ok: true; callSid: string }

package/src/__tests__/list-messages-attachments.test.ts

@@ -39,7 +39,7 @@ mock.module("../config/loader.js", () => ({
     model: "test",
     provider: "test",
     memory: { enabled: false },
-    rateLimit: { maxRequestsPerMinute: 0, maxTokensPerSession: 0 },
+    rateLimit: { maxRequestsPerMinute: 0 },
   }),
 }));
 

package/src/__tests__/managed-proxy-context.test.ts

@@ -110,10 +110,7 @@ describe("buildManagedBaseUrl", () => {
       "https://platform.example.com/v1/runtime-proxy/anthropic",
     );
     expect(await buildManagedBaseUrl("gemini")).toBe(
-      "https://platform.example.com/v1/runtime-proxy/vertex",
-    );
-    expect(await buildManagedBaseUrl("vertex")).toBe(
-      "https://platform.example.com/v1/runtime-proxy/vertex",
+      "https://platform.example.com/v1/runtime-proxy/gemini",
     );
   });
 
@@ -132,7 +129,7 @@ describe("buildManagedBaseUrl", () => {
     mockPlatformBaseUrl = "";
     mockAssistantApiKey = null;
     expect(await buildManagedBaseUrl("anthropic")).toBeUndefined();
-    expect(await buildManagedBaseUrl("vertex")).toBeUndefined();
+    expect(await buildManagedBaseUrl("gemini")).toBeUndefined();
   });
 });
 

package/src/__tests__/managed-skill-lifecycle.test.ts

@@ -16,8 +16,7 @@ const mockConfig = {
     shellMaxTimeoutSec: 600,
     permissionTimeoutSec: 300,
   },
-  sandbox: { enabled: false },
-  rateLimit: { maxRequestsPerMinute: 0, maxTokensPerSession: 0 },
+  rateLimit: { maxRequestsPerMinute: 0 },
   secretDetection: {
     enabled: true,
     action: "warn" as const,
@@ -33,9 +32,9 @@ const mockConfig = {
     "image-generation": {
       mode: "your-own",
       provider: "gemini",
-      model: "gemini-2.5-flash-image",
+      model: "gemini-3.1-flash-image-preview",
     },
-    "web-search": { mode: "your-own", provider: "anthropic-native" },
+    "web-search": { mode: "your-own", provider: "inference-provider-native" },
   },
 };
 
@@ -138,11 +137,12 @@ describe("managed skill lifecycle: scaffold → catalog → prompt → delete",
     expect(found!.name).toBe("Lifecycle Test");
     expect(found!.description).toBe("Integration test skill.");
 
-    // Step 4: Verify skill appears in system prompt
+    // Step 4: Verify skill appears in system prompt (markdown bullet: **id**: description)
     const prompt = buildSystemPrompt();
-    expect(prompt).toContain("lifecycle-test");
-    expect(prompt).toContain("Lifecycle Test");
-    expect(prompt).toContain("## Dynamic Skill Authoring Workflow");
+    expect(prompt).toContain("**lifecycle-test**");
+    expect(prompt).toContain("Integration test skill");
+    // Dynamic Skill Authoring section moved to tool descriptions; prompt should not contain it
+    expect(prompt).not.toContain("## Dynamic Skill Authoring Workflow");
 
     // Step 5: Delete the skill
     const deleteResult = await executeDeleteManagedSkill(