@vellumai/assistant 0.4.56 → 0.4.57

package/src/__tests__/migration-import-preflight-http.test.ts

@@ -34,13 +34,14 @@ function toArrayBuffer(data: Uint8Array): ArrayBuffer {
 const testDir = realpathSync(
   mkdtempSync(join(tmpdir(), "migration-import-preflight-http-test-")),
 );
-const testDbDir = join(testDir, "db");
+const testDbDir = join(testDir, "data", "db");
 const testDbPath = join(testDbDir, "assistant.db");
 const testConfigPath = join(testDir, "config.json");
 
 mock.module("../util/platform.js", () => ({
   getRootDir: () => testDir,
-  getDataDir: () => testDir,
+  getDataDir: () => join(testDir, "data"),
+  getWorkspaceDir: () => testDir,
   getWorkspaceConfigPath: () => testConfigPath,
   isMacOS: () => process.platform === "darwin",
   isLinux: () => process.platform === "linux",
@@ -64,9 +65,8 @@ mock.module("../config/loader.js", () => ({
     model: "test",
     provider: "test",
     memory: { enabled: false },
-    rateLimit: { maxRequestsPerMinute: 0, maxTokensPerSession: 0 },
+    rateLimit: { maxRequestsPerMinute: 0 },
     secretDetection: { enabled: false },
-    sandbox: { enabled: false },
   }),
 }));
 
@@ -525,8 +525,8 @@ describe("handleMigrationImportPreflight — validation failures", () => {
 describe("analyzeImport", () => {
   test("detects create when file does not exist on disk", () => {
     const resolver = new DefaultPathResolver(
-      join(testDir, "nonexistent.db"),
-      join(testDir, "nonexistent-config.json"),
+      undefined,
+      join(testDir, "nonexistent-workspace"),
     );
 
     const report = analyzeImport({
@@ -553,7 +553,7 @@ describe("analyzeImport", () => {
   });
 
   test("detects unchanged when file on disk matches bundle", () => {
-    const resolver = new DefaultPathResolver(testDbPath, testConfigPath);
+    const resolver = new DefaultPathResolver(undefined, testDir);
 
     const report = analyzeImport({
       manifest: {
@@ -577,7 +577,7 @@ describe("analyzeImport", () => {
   });
 
   test("detects overwrite when file on disk differs from bundle", () => {
-    const resolver = new DefaultPathResolver(testDbPath, testConfigPath);
+    const resolver = new DefaultPathResolver(undefined, testDir);
 
     const report = analyzeImport({
       manifest: {
@@ -602,7 +602,7 @@ describe("analyzeImport", () => {
   });
 
   test("flags unknown archive paths as conflicts with skip action", () => {
-    const resolver = new DefaultPathResolver(testDbPath, testConfigPath);
+    const resolver = new DefaultPathResolver(undefined, testDir);
 
     const report = analyzeImport({
       manifest: {
@@ -640,7 +640,7 @@ describe("analyzeImport", () => {
   });
 
   test("includes manifest in report", () => {
-    const resolver = new DefaultPathResolver(testDbPath, testConfigPath);
+    const resolver = new DefaultPathResolver(undefined, testDir);
     const manifest = {
       schema_version: "1.0",
       created_at: "2024-01-01T00:00:00.000Z",
@@ -668,29 +668,90 @@ describe("analyzeImport", () => {
 // ---------------------------------------------------------------------------
 
 describe("DefaultPathResolver", () => {
-  test("resolves data/db/assistant.db to configured db path", () => {
+  test("resolves data/db/assistant.db to workspace db path (backward compat)", () => {
     const resolver = new DefaultPathResolver(
-      "/some/db.db",
-      "/some/config.json",
+      undefined,
+      "/home/user/.vellum/workspace",
+    );
+    expect(resolver.resolve("data/db/assistant.db")).toBe(
+      "/home/user/.vellum/workspace/data/db/assistant.db",
     );
-    expect(resolver.resolve("data/db/assistant.db")).toBe("/some/db.db");
   });
 
-  test("resolves config/settings.json to configured config path", () => {
+  test("resolves config/settings.json to workspace config path (backward compat)", () => {
     const resolver = new DefaultPathResolver(
-      "/some/db.db",
-      "/some/config.json",
+      undefined,
+      "/home/user/.vellum/workspace",
+    );
+    expect(resolver.resolve("config/settings.json")).toBe(
+      "/home/user/.vellum/workspace/config.json",
     );
-    expect(resolver.resolve("config/settings.json")).toBe("/some/config.json");
   });
 
   test("returns null for unknown paths", () => {
     const resolver = new DefaultPathResolver(
-      "/some/db.db",
-      "/some/config.json",
+      undefined,
+      "/home/user/.vellum/workspace",
     );
     expect(resolver.resolve("unknown/path.txt")).toBeNull();
   });
+
+  test("resolves valid skills path via backward compat", () => {
+    const resolver = new DefaultPathResolver(
+      undefined,
+      "/home/user/.vellum/workspace",
+    );
+    expect(resolver.resolve("skills/my-skill/SKILL.md")).toBe(
+      "/home/user/.vellum/workspace/skills/my-skill/SKILL.md",
+    );
+  });
+
+  test("resolves workspace/ prefix paths", () => {
+    const resolver = new DefaultPathResolver(
+      undefined,
+      "/home/user/.vellum/workspace",
+    );
+    expect(resolver.resolve("workspace/data/db/assistant.db")).toBe(
+      "/home/user/.vellum/workspace/data/db/assistant.db",
+    );
+    expect(resolver.resolve("workspace/config.json")).toBe(
+      "/home/user/.vellum/workspace/config.json",
+    );
+    expect(resolver.resolve("workspace/skills/my-skill/SKILL.md")).toBe(
+      "/home/user/.vellum/workspace/skills/my-skill/SKILL.md",
+    );
+  });
+
+  test("returns null for workspace/ path traversal attempt", () => {
+    const resolver = new DefaultPathResolver(
+      undefined,
+      "/home/user/.vellum/workspace",
+    );
+    expect(resolver.resolve("workspace/../../etc/passwd")).toBeNull();
+  });
+
+  test("returns null for skills path traversal attempt (../../etc/passwd)", () => {
+    const resolver = new DefaultPathResolver(
+      undefined,
+      "/home/user/.vellum/workspace",
+    );
+    expect(resolver.resolve("skills/../../etc/passwd")).toBeNull();
+  });
+
+  test("returns null for skills path traversal attempt (../../../.ssh/authorized_keys)", () => {
+    const resolver = new DefaultPathResolver(
+      undefined,
+      "/home/user/.vellum/workspace",
+    );
+    expect(
+      resolver.resolve("skills/../../../.ssh/authorized_keys"),
+    ).toBeNull();
+  });
+
+  test("returns null for skills paths when workspaceDir is not provided", () => {
+    const resolver = new DefaultPathResolver();
+    expect(resolver.resolve("skills/my-skill/SKILL.md")).toBeNull();
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/__tests__/migration-validate-http.test.ts

@@ -53,9 +53,8 @@ mock.module("../config/loader.js", () => ({
     model: "test",
     provider: "test",
     memory: { enabled: false },
-    rateLimit: { maxRequestsPerMinute: 0, maxTokensPerSession: 0 },
+    rateLimit: { maxRequestsPerMinute: 0 },
     secretDetection: { enabled: false },
-    sandbox: { enabled: false },
   }),
 }));
 
@@ -307,26 +306,27 @@ describe("validateVBundle", () => {
     expect(manifestError).toBeDefined();
   });
 
-  test("missing data/db/assistant.db returns MISSING_ENTRY error", () => {
-    const manifestData = new TextEncoder().encode(
-      JSON.stringify({
-        schema_version: "1.0",
-        created_at: new Date().toISOString(),
-        files: [],
-        manifest_sha256: "placeholder",
-      }),
-    );
+  test("bundle with only manifest (no data files) is structurally valid", () => {
+    // After the workspace walk refactor, only manifest.json is required.
+    // But the manifest checksum must match for full validity.
+    const manifestWithoutChecksum = {
+      schema_version: "1.0",
+      created_at: new Date().toISOString(),
+      files: [],
+    };
+    const manifestSha256 = sha256Hex(canonicalizeJson(manifestWithoutChecksum));
+    const manifest = {
+      ...manifestWithoutChecksum,
+      manifest_sha256: manifestSha256,
+    };
+    const manifestData = new TextEncoder().encode(JSON.stringify(manifest));
     const tar = createTarArchive([
       { name: "manifest.json", data: manifestData },
     ]);
     const vbundle = gzipSync(tar);
     const result = validateVBundle(vbundle);
 
-    expect(result.is_valid).toBe(false);
-    const dbError = result.errors.find(
-      (e) => e.code === "MISSING_ENTRY" && e.path === "data/db/assistant.db",
-    );
-    expect(dbError).toBeDefined();
+    expect(result.is_valid).toBe(true);
   });
 
   test("invalid manifest JSON returns INVALID_MANIFEST_JSON error", () => {

package/src/__tests__/model-intents.test.ts

@@ -62,7 +62,7 @@ describe("model intents", () => {
       "claude-opus-4-6",
     );
     expect(resolveModelIntent("anthropic", "vision-optimized")).toBe(
-      "claude-sonnet-4-6",
+      "claude-opus-4-6",
     );
     expect(resolveModelIntent("openai", "latency-optimized")).toBe(
       "gpt-4o-mini",

package/src/__tests__/no-domain-routing-in-prompt-guard.test.ts

@@ -5,7 +5,7 @@ import { describe, expect, test } from "bun:test";
 /**
  * Guard test: domain-specific routing sections must NOT appear in the system
  * prompt source file. Routing cues now live in skill frontmatter
- * (`activation-hints` / `avoid-when`) and are projected into `<available_skills>` XML.
+ * (`activation-hints` / `avoid-when`) and are projected into the skills catalog.
  *
  * If this test fails, you are re-introducing hardcoded routing into the system
  * prompt. Instead, add `activation-hints` to the skill's SKILL.md frontmatter.

package/src/__tests__/notification-broadcaster.test.ts

@@ -115,7 +115,7 @@ function makeSignal(
     signalId: "sig-broadcast-001",
     createdAt: Date.now(),
     sourceChannel: "scheduler",
-    sourceSessionId: "sess-001",
+    sourceContextId: "sess-001",
     sourceEventName: "test.event",
     contextPayload: {},
     attentionHints: {

package/src/__tests__/notification-decision-fallback.test.ts

@@ -65,7 +65,7 @@ function makeSignal(
     signalId: "sig-fallback-guardian-1",
     createdAt: Date.now(),
     sourceChannel: "phone",
-    sourceSessionId: "call-session-1",
+    sourceContextId: "call-session-1",
     sourceEventName: "guardian.question",
     contextPayload: {
       questionText: "What is the gate code?",
@@ -308,7 +308,7 @@ describe("access-request instruction enforcement", () => {
       signalId: "sig-access-req-1",
       createdAt: Date.now(),
       sourceChannel: "telegram",
-      sourceSessionId: "tg-session-1",
+      sourceContextId: "tg-session-1",
       sourceEventName: "ingress.access_request",
       contextPayload: {
         senderIdentifier: "Alice",

package/src/__tests__/notification-decision-identity.test.ts

@@ -45,7 +45,9 @@ mock.module("../prompts/system-prompt.js", () => ({
 
 // ── Provider mock with system prompt capture ──────────────────────────
 
-let configuredProvider: { sendMessage: (...args: unknown[]) => Promise<unknown> } | null = null;
+let configuredProvider: {
+  sendMessage: (...args: unknown[]) => Promise<unknown>;
+} | null = null;
 let extractedToolUse: unknown = null;
 let capturedSystemPrompt: string | undefined;
 
@@ -81,7 +83,7 @@ function makeSignal(
     signalId: "sig-identity-test-1",
     createdAt: Date.now(),
     sourceChannel: "phone",
-    sourceSessionId: "call-session-1",
+    sourceContextId: "call-session-1",
     sourceEventName: "guardian.question",
     contextPayload: {
       questionText: "What is the gate code?",
@@ -141,9 +143,7 @@ describe("identity context in notification decision engine", () => {
 
     expect(capturedSystemPrompt).toBeDefined();
     expect(capturedSystemPrompt).toContain("<assistant-identity>");
-    expect(capturedSystemPrompt).toContain(
-      "I am Jarvis, a helpful assistant",
-    );
+    expect(capturedSystemPrompt).toContain("I am Jarvis, a helpful assistant");
     expect(capturedSystemPrompt).toContain("</assistant-identity>");
   });
 
@@ -192,10 +192,9 @@ describe("identity context in notification decision engine", () => {
     configuredProvider = null;
 
     const signal = makeSignal();
-    const decision = await evaluateSignal(
-      signal,
-      ["vellum"] as NotificationChannel[],
-    );
+    const decision = await evaluateSignal(signal, [
+      "vellum",
+    ] as NotificationChannel[]);
 
     // Fallback should produce valid copy regardless of identity context
     expect(decision.fallbackUsed).toBe(true);

package/src/__tests__/notification-decision-strategy.test.ts

@@ -38,7 +38,7 @@ function makeSignal(
     signalId: "sig-test-001",
     createdAt: Date.now(),
     sourceChannel: "scheduler",
-    sourceSessionId: "sess-001",
+    sourceContextId: "sess-001",
     sourceEventName: "test.event",
     contextPayload: {},
     attentionHints: {

package/src/__tests__/notification-deep-link.test.ts

@@ -89,7 +89,7 @@ function makeSignal(
     signalId: "sig-deeplink-001",
     createdAt: Date.now(),
     sourceChannel: "scheduler",
-    sourceSessionId: "sess-001",
+    sourceContextId: "sess-001",
     sourceEventName: "test.event",
     contextPayload: {},
     attentionHints: {

package/src/__tests__/notification-guardian-path.test.ts

@@ -239,7 +239,6 @@ describe("ASK_GUARDIAN canonical notification path", () => {
 
     const signalParams = emitCalls[0] as Record<string, unknown>;
     expect(typeof signalParams.onConversationCreated).toBe("function");
-    expect(signalParams.skipVellumThread).toBeUndefined();
   });
 
   test("creates guardian action deliveries from notification pipeline delivery results", async () => {

package/src/__tests__/notification-schedule-dedup.test.ts

@@ -72,7 +72,7 @@ function makeSignal(
     signalId: `sig-${crypto.randomUUID()}`,
     createdAt: Date.now(),
     sourceChannel: "scheduler",
-    sourceSessionId: "schedule-123",
+    sourceContextId: "schedule-123",
     sourceEventName: "schedule.complete",
     contextPayload: { scheduleId: "schedule-123", name: "Drink water" },
     attentionHints: {
@@ -118,7 +118,7 @@ describe("recurring schedule notification dedup", () => {
       id: firstSignal.signalId,
       sourceEventName: "schedule.complete",
       sourceChannel: "scheduler",
-      sourceSessionId: "schedule-123",
+      sourceContextId: "schedule-123",
       attentionHints: firstSignal.attentionHints,
       payload: firstSignal.contextPayload,
       // No dedupeKey — this is the bug scenario
@@ -132,7 +132,7 @@ describe("recurring schedule notification dedup", () => {
       id: secondSignal.signalId,
       sourceEventName: "schedule.complete",
       sourceChannel: "scheduler",
-      sourceSessionId: "schedule-123",
+      sourceContextId: "schedule-123",
       attentionHints: secondSignal.attentionHints,
       payload: secondSignal.contextPayload,
     });
@@ -160,7 +160,7 @@ describe("recurring schedule notification dedup", () => {
       id: firstSignal.signalId,
       sourceEventName: "schedule.complete",
       sourceChannel: "scheduler",
-      sourceSessionId: "schedule-123",
+      sourceContextId: "schedule-123",
       attentionHints: firstSignal.attentionHints,
       payload: firstSignal.contextPayload,
       dedupeKey: `schedule:complete:schedule-123:${Date.now() - 60_000}`,
@@ -173,7 +173,7 @@ describe("recurring schedule notification dedup", () => {
       id: secondSignal.signalId,
       sourceEventName: "schedule.complete",
       sourceChannel: "scheduler",
-      sourceSessionId: "schedule-123",
+      sourceContextId: "schedule-123",
       attentionHints: secondSignal.attentionHints,
       payload: secondSignal.contextPayload,
       dedupeKey: `schedule:complete:schedule-123:${Date.now()}`,
@@ -204,7 +204,7 @@ describe("recurring schedule notification dedup", () => {
       id: firstSignal.signalId,
       sourceEventName: "schedule.notify",
       sourceChannel: "scheduler",
-      sourceSessionId: "schedule-123",
+      sourceContextId: "schedule-123",
       attentionHints: firstSignal.attentionHints,
       payload: firstSignal.contextPayload,
       dedupeKey: `schedule:notify:schedule-123:${Date.now() - 60_000}`,
@@ -219,7 +219,7 @@ describe("recurring schedule notification dedup", () => {
       id: secondSignal.signalId,
       sourceEventName: "schedule.notify",
       sourceChannel: "scheduler",
-      sourceSessionId: "schedule-123",
+      sourceContextId: "schedule-123",
       attentionHints: secondSignal.attentionHints,
       payload: secondSignal.contextPayload,
       dedupeKey: `schedule:notify:schedule-123:${Date.now()}`,

package/src/__tests__/oauth-store.test.ts

@@ -83,9 +83,7 @@ async function createTestApp(providerKey = "github", clientId = "client-1") {
 }
 
 beforeEach(() => {
-  resetDb();
-  initializeDb();
-  // Explicitly clear all OAuth tables to prevent cross-test state pollution.
+  // Clear OAuth tables between tests instead of full DB reset + migration.
   // Delete in FK-dependency order: connections → apps → providers.
   resetTestTables("oauth_connections", "oauth_apps", "oauth_providers");
   mockDeleteSecureKeyAsync.mockClear();

package/src/__tests__/oauth2-gateway-transport.test.ts

@@ -484,17 +484,22 @@ describe("OAuth2 gateway transport", () => {
       };
 
       let capturedAuthUrl = "";
+      let urlReady!: () => void;
+      const urlReadyPromise = new Promise<void>((r) => {
+        urlReady = r;
+      });
       const flowPromise = startOAuth2Flow(
         BASE_OAUTH_CONFIG,
         {
           openUrl: (url) => {
             capturedAuthUrl = url;
+            urlReady();
           },
         },
         { callbackTransport: "loopback" },
       );
 
-      await new Promise((r) => setTimeout(r, 50));
+      await urlReadyPromise;
 
       const authUrl = new URL(capturedAuthUrl);
       const redirectUri = authUrl.searchParams.get("redirect_uri")!;

package/src/__tests__/onboarding-template-contract.test.ts

@@ -9,14 +9,19 @@ const user = readFileSync(join(templatesDir, "USER.md"), "utf-8");
 
 describe("onboarding template contracts", () => {
   describe("BOOTSTRAP.md", () => {
-    test("contains identity question prompts", () => {
+    test("preserves comment line format instruction", () => {
+      expect(bootstrap).toMatch(/^_ Lines starting with _/);
+    });
+
+    test("contains identity discovery prompts", () => {
       const lower = bootstrap.toLowerCase();
-      expect(lower).toContain("who am i");
+      expect(lower).toContain("your name");
+      expect(lower).toContain("personality");
+      expect(lower).toContain("avatar");
     });
 
     test("infers personality organically instead of asking directly", () => {
       const lower = bootstrap.toLowerCase();
-      // Personality step must instruct organic discovery via conversation
       expect(lower).toContain("personality");
       expect(lower).toContain("emerge");
       expect(lower).toContain("vibe");
@@ -28,28 +33,17 @@ describe("onboarding template contracts", () => {
       expect(lower).toContain("change it later");
     });
 
-    test("contains naming intent markers so the first reply includes naming cues", () => {
-      const lower = bootstrap.toLowerCase();
-      // The template must prompt the assistant to ask about names.
-      expect(lower).toContain("name");
-      // The first step should be about the assistant's name
-      expect(lower).toContain("your name");
-      // The conversation sequence must include identity/naming
-      expect(lower).toContain("who am i");
-    });
-
-    test("asks user name AFTER assistant identity is established", () => {
-      // Step 1 is the assistant's name, step 4 is asking the user's name
-      const assistantNameIdx = bootstrap.indexOf("Your name:");
-      const userNameIdx = bootstrap.indexOf("who am I talking to?");
-      expect(assistantNameIdx).toBeGreaterThan(-1);
-      expect(userNameIdx).toBeGreaterThan(-1);
-      expect(assistantNameIdx).toBeLessThan(userNameIdx);
+    test("asks about user after assistant identity", () => {
+      const nameIdx = bootstrap.indexOf("Your name");
+      const theirNameIdx = bootstrap.indexOf("Their name");
+      expect(nameIdx).toBeGreaterThan(-1);
+      expect(theirNameIdx).toBeGreaterThan(-1);
+      expect(nameIdx).toBeLessThan(theirNameIdx);
     });
 
     test("gathers user context: work role, hobbies, daily tools", () => {
       const lower = bootstrap.toLowerCase();
-      expect(lower).toContain("work");
+      expect(lower).toContain("work role");
       expect(lower).toContain("hobbies");
       expect(lower).toContain("tools");
     });
@@ -57,51 +51,32 @@ describe("onboarding template contracts", () => {
     test("shows exactly 2 suggestions via ui_show card with relay_prompt actions", () => {
       expect(bootstrap).toContain("ui_show");
       expect(bootstrap).toContain("exactly 2");
-      // Must use card surface with relay_prompt action buttons
-      expect(bootstrap).toContain('surface_type: "card"');
       expect(bootstrap).toContain("relay_prompt");
     });
 
-    test("contains completion gate with all required conditions", () => {
+    test("contains wrapping-up criteria with required conditions", () => {
       const lower = bootstrap.toLowerCase();
-      expect(lower).toContain("completion gate");
-      expect(lower).toContain("do not delete this file");
-      // Assistant name is hard-required
-      expect(lower).toContain("you have a name");
-      expect(lower).toContain("hard-required");
+      expect(lower).toContain("wrapping up");
+      expect(lower).toContain("done with onboarding");
       expect(lower).toContain("vibe");
-      // User detail fields must be resolved (provided, inferred, or declined)
-      expect(lower).toContain("resolved");
-      expect(lower).toContain("work role");
-      expect(lower).toContain("2 suggestions from step 6");
+      expect(lower).toContain("two suggestions");
     });
 
     test("contains refusal policy", () => {
       const lower = bootstrap.toLowerCase();
-      // Assistant name is hard-required, user details are best-effort
       expect(lower).toContain("hard-required");
       expect(lower).toContain("best-effort");
-      // Refusal is a valid resolution
       expect(lower).toContain("declined");
-      expect(lower).toContain("do not push");
+      expect(lower).toContain("not interrogation");
     });
 
     test("defines resolved as provided, inferred, or declined", () => {
       const lower = bootstrap.toLowerCase();
-      // The template must define what "resolved" means
       expect(lower).toContain("resolved");
       expect(lower).toContain("inferred");
       expect(lower).toContain("declined");
     });
 
-    // em-dash and technical jargon instructions are now hardcoded in the system
-    // prompt builder (buildSystemPrompt) rather than in the BOOTSTRAP.md template.
-
-    test("preserves comment line format instruction", () => {
-      // The template must start with the comment format explanation
-      expect(bootstrap).toMatch(/^_ Lines starting with _/);
-    });
-
     test("instructs saving to IDENTITY.md, USER.md, and SOUL.md via file_edit", () => {
       expect(bootstrap).toContain("IDENTITY.md");
       expect(bootstrap).toContain("USER.md");
@@ -118,18 +93,13 @@ describe("onboarding template contracts", () => {
       expect(identity).toContain("**Emoji:**");
     });
 
-    test("contains the emoji overwrite instruction", () => {
-      const lower = identity.toLowerCase();
-      expect(lower).toContain("change their emoji");
-    });
-
-    test("contains the style tendency field", () => {
-      expect(identity).toContain("**Style tendency:**");
+    test("contains parsed field format guidance", () => {
+      expect(identity).toContain("parsed by the app");
     });
   });
 
   describe("USER.md", () => {
-    test("contains onboarding snapshot with all required fields", () => {
+    test("contains profile fields", () => {
       expect(user).toContain("Preferred name/reference:");
       expect(user).toContain("Goals:");
       expect(user).toContain("Locale:");
@@ -137,11 +107,5 @@ describe("onboarding template contracts", () => {
       expect(user).toContain("Hobbies/fun:");
       expect(user).toContain("Daily tools:");
     });
-
-    test("documents resolved-field status conventions", () => {
-      const lower = user.toLowerCase();
-      expect(lower).toContain("declined_by_user");
-      expect(lower).toContain("resolved");
-    });
   });
 });