@vellumai/assistant 0.4.57 → 0.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.4.57",
+  "version": "0.5.1",
   "type": "module",
   "exports": {
     ".": "./src/index.ts"

package/src/__tests__/assistant-feature-flags-integration.test.ts

@@ -228,7 +228,7 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
     expect(result).not.toContain(`**${DECLARED_SKILL_ID}**`);
   });
 
-  test("declared skills hidden when no flag overrides set (registry defaults to false)", () => {
+  test("contacts visible but email-channel hidden when no flag overrides set (contacts defaults true, email-channel defaults false)", () => {
     createSkillOnDisk(
       DECLARED_SKILL_ID,
       "Contacts",
@@ -263,8 +263,8 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
 
     const result = buildSystemPrompt();
 
-    // Both skills declare feature flags with registry defaultEnabled: false
-    expect(result).not.toContain(`**${DECLARED_SKILL_ID}**`);
+    // contacts defaults to true, email-channel defaults to false
+    expect(result).toContain(`**${DECLARED_SKILL_ID}**`);
     expect(result).not.toContain("**email-channel**");
   });
 
@@ -466,12 +466,10 @@ describe("isAssistantFeatureFlagEnabled", () => {
 
   test("missing persisted value falls back to defaults registry defaultEnabled", () => {
     // No explicit config at all — should fall back to defaults registry
-    // which has defaultEnabled: false for contacts
+    // which has defaultEnabled: true for contacts
     const config = {} as any;
 
-    expect(isAssistantFeatureFlagEnabled(DECLARED_FLAG_KEY, config)).toBe(
-      false,
-    );
+    expect(isAssistantFeatureFlagEnabled(DECLARED_FLAG_KEY, config)).toBe(true);
   });
 
   test("unknown flag defaults to true when no persisted override", () => {
@@ -510,7 +508,7 @@ describe("isAssistantFeatureFlagEnabled with skillFlagKey", () => {
     ).toBe(false);
   });
 
-  test("disabled when no override set (registry default is false)", () => {
+  test("enabled when no override set (registry default is true)", () => {
     const config = {} as any;
 
     expect(
@@ -518,6 +516,6 @@ describe("isAssistantFeatureFlagEnabled with skillFlagKey", () => {
         skillFlagKey({ featureFlag: DECLARED_FLAG_ID })!,
         config,
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
 });

package/src/__tests__/conversation-runtime-assembly.test.ts

@@ -1055,39 +1055,46 @@ describe("applyRuntimeInjections with inboundActorContext", () => {
 
 describe("buildTurnContextBlock (channel-only)", () => {
   test("collapses to single field when all channels match", () => {
-    const block = buildTurnContextBlock({
-      turnContext: {
-        userMessageChannel: "telegram",
-        assistantMessageChannel: "telegram",
+    const block = buildTurnContextBlock(
+      {
+        turnContext: {
+          userMessageChannel: "telegram",
+          assistantMessageChannel: "telegram",
+        },
+        conversationOriginChannel: "telegram",
       },
-      conversationOriginChannel: "telegram",
-    }, undefined);
+      undefined,
+    );
     expect(block).toBe(
-      "<turn_context>\n" +
-        "channel: telegram\n" +
-        "</turn_context>",
+      "<turn_context>\n" + "channel: telegram\n" + "</turn_context>",
     );
   });
 
   test('uses "unknown" when conversationOriginChannel is null', () => {
-    const block = buildTurnContextBlock({
-      turnContext: {
-        userMessageChannel: "vellum",
-        assistantMessageChannel: "vellum",
+    const block = buildTurnContextBlock(
+      {
+        turnContext: {
+          userMessageChannel: "vellum",
+          assistantMessageChannel: "vellum",
+        },
+        conversationOriginChannel: null,
       },
-      conversationOriginChannel: null,
-    }, undefined);
+      undefined,
+    );
     expect(block).toContain("conversation_origin_channel: unknown");
   });
 
   test("handles mixed channels", () => {
-    const block = buildTurnContextBlock({
-      turnContext: {
-        userMessageChannel: "telegram",
-        assistantMessageChannel: "vellum",
+    const block = buildTurnContextBlock(
+      {
+        turnContext: {
+          userMessageChannel: "telegram",
+          assistantMessageChannel: "vellum",
+        },
+        conversationOriginChannel: "vellum",
       },
-      conversationOriginChannel: "vellum",
-    }, undefined);
+      undefined,
+    );
     expect(block).toContain("user_message_channel: telegram");
     expect(block).toContain("assistant_message_channel: vellum");
     expect(block).toContain("conversation_origin_channel: vellum");

package/src/__tests__/credential-execution-feature-gates.test.ts

@@ -154,16 +154,16 @@ describe("CES flags do not affect unrelated flags", () => {
     ).toBe(true);
   });
 
-  test("enabling all CES flags does not change contacts flag (defaultEnabled: false)", () => {
+  test("enabling all CES flags does not change contacts flag (defaultEnabled: true)", () => {
     const overrides: Record<string, boolean> = {};
     for (const key of ALL_CES_FLAG_KEYS) {
       overrides[key] = true;
     }
     const config = makeConfig(overrides);
 
-    // contacts defaults to false in the registry and should stay false
+    // contacts defaults to true in the registry and should stay true
     expect(
       isAssistantFeatureFlagEnabled("feature_flags.contacts.enabled", config),
-    ).toBe(false);
+    ).toBe(true);
   });
 });

package/src/__tests__/encrypted-store.test.ts

@@ -1,8 +1,4 @@
-import {
-  createCipheriv,
-  pbkdf2Sync,
-  randomBytes,
-} from "node:crypto";
+import { createCipheriv, pbkdf2Sync, randomBytes } from "node:crypto";
 import {
   chmodSync,
   existsSync,
@@ -72,11 +68,23 @@ const SALT_LENGTH = 32;
 /** Local copy of the legacy machine entropy derivation (the export was removed). */
 function legacyMachineEntropy(): string {
   const parts: string[] = [];
-  try { parts.push(hostname()); } catch { parts.push("unknown-host"); }
-  try { parts.push(userInfo().username); } catch { parts.push("unknown-user"); }
+  try {
+    parts.push(hostname());
+  } catch {
+    parts.push("unknown-host");
+  }
+  try {
+    parts.push(userInfo().username);
+  } catch {
+    parts.push("unknown-user");
+  }
   parts.push(process.platform);
   parts.push(process.arch);
-  try { parts.push(userInfo().homedir); } catch { parts.push("/tmp"); }
+  try {
+    parts.push(userInfo().homedir);
+  } catch {
+    parts.push("/tmp");
+  }
   return parts.join(":");
 }
 
@@ -346,7 +354,8 @@ describe("encrypted-store", () => {
       // Create a v1 store using legacy encryption
       const salt = randomBytes(SALT_LENGTH);
       const legacyKey = legacyDeriveKey(salt);
-      const entries: Record<string, { iv: string; tag: string; data: string }> = {};
+      const entries: Record<string, { iv: string; tag: string; data: string }> =
+        {};
       entries["api-key"] = legacyEncrypt("secret-123", legacyKey);
       entries["other-key"] = legacyEncrypt("secret-456", legacyKey);
       writeV1Store(STORE_PATH, salt, entries);
@@ -372,7 +381,8 @@ describe("encrypted-store", () => {
       // Create a v1 store
       const salt = randomBytes(SALT_LENGTH);
       const legacyKey = legacyDeriveKey(salt);
-      const entries: Record<string, { iv: string; tag: string; data: string }> = {};
+      const entries: Record<string, { iv: string; tag: string; data: string }> =
+        {};
       entries["my-key"] = legacyEncrypt("my-value", legacyKey);
       writeV1Store(STORE_PATH, salt, entries);
 
@@ -393,7 +403,8 @@ describe("encrypted-store", () => {
       // Create a v1 store with one good entry and one tampered entry
       const salt = randomBytes(SALT_LENGTH);
       const legacyKey = legacyDeriveKey(salt);
-      const entries: Record<string, { iv: string; tag: string; data: string }> = {};
+      const entries: Record<string, { iv: string; tag: string; data: string }> =
+        {};
       entries["good"] = legacyEncrypt("good-value", legacyKey);
       entries["bad"] = legacyEncrypt("bad-value", legacyKey);
       // Tamper with the bad entry
@@ -423,7 +434,8 @@ describe("encrypted-store", () => {
       // write v1 store + store.key but leave store as v1
       const salt = randomBytes(SALT_LENGTH);
       const legacyKey = legacyDeriveKey(salt);
-      const entries: Record<string, { iv: string; tag: string; data: string }> = {};
+      const entries: Record<string, { iv: string; tag: string; data: string }> =
+        {};
       entries["test-key"] = legacyEncrypt("test-value", legacyKey);
       writeV1Store(STORE_PATH, salt, entries);
 

package/src/__tests__/file-read-tool.test.ts

@@ -177,3 +177,43 @@ describe("file_read image support", () => {
     expect(result.content).toContain("outside the working directory");
   });
 });
+
+// ── Out-of-bounds hint for host_file_read ─────────────────────────────
+
+describe("file_read out-of-bounds hint", () => {
+  test("suggests host_file_read for out-of-bounds text file path", async () => {
+    const dir = makeTempDir();
+
+    const result = await fileReadTool.execute(
+      { path: "/etc/passwd" },
+      makeContext(dir),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("host_file_read");
+  });
+
+  test("suggests host_file_read for out-of-bounds image file path", async () => {
+    const dir = makeTempDir();
+
+    const result = await fileReadTool.execute(
+      { path: "/Users/someone/Desktop/screenshot.png" },
+      makeContext(dir),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("host_file_read");
+  });
+
+  test("does not suggest host_file_read for missing file within sandbox", async () => {
+    const dir = makeTempDir();
+
+    const result = await fileReadTool.execute(
+      { path: "nonexistent.txt" },
+      makeContext(dir),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).not.toContain("host_file_read");
+  });
+});

package/src/__tests__/filesystem-tools.test.ts

@@ -325,12 +325,14 @@ describe("formatEditDiff", () => {
     expect(result).not.toContain("+ ");
   });
 
-  test("truncates long diffs beyond 8 lines", () => {
+  test("shows all diff lines without truncation", () => {
     const longOld = Array.from({ length: 12 }, (_, i) => `old-line-${i}`).join(
       "\n",
     );
     const result = formatEditDiff(longOld, "short");
-    expect(result).toContain("more lines");
+    expect(result).not.toContain("more lines");
+    expect(result).toContain("old-line-11");
+    expect(result).toContain("+ short");
   });
 });
 

package/src/__tests__/history-repair.test.ts

@@ -588,6 +588,77 @@ describe("repairHistory", () => {
     });
   });
 
+  test("synthetic web_search_tool_result is placed immediately after its server_tool_use, not at end", () => {
+    // Regression: synthetic results appended to the end of the content array
+    // get separated from their server_tool_use by ensureToolPairing's split
+    // at tool_use boundaries, causing the API to reject with "web_search
+    // tool use without a corresponding web_search_tool_result block".
+    const messages: Message[] = [
+      { role: "user", content: [{ type: "text", text: "Search and act" }] },
+      {
+        role: "assistant",
+        content: [
+          { type: "text", text: "Let me search" },
+          {
+            type: "server_tool_use",
+            id: "stu_1",
+            name: "web_search",
+            input: { query: "openai" },
+          },
+          {
+            type: "server_tool_use",
+            id: "stu_2",
+            name: "web_search",
+            input: { query: "anthropic" },
+          },
+          { type: "text", text: "Based on my research" },
+          {
+            type: "tool_use",
+            id: "tu_1",
+            name: "skill_load",
+            input: { skill: "app-builder" },
+          },
+        ],
+      },
+      {
+        role: "user",
+        content: [
+          {
+            type: "tool_result",
+            tool_use_id: "tu_1",
+            content: "Skill loaded",
+          },
+        ],
+      },
+    ];
+
+    const { messages: repaired, stats } = repairHistory(messages);
+
+    expect(stats.missingToolResultsInserted).toBe(2);
+
+    const assistantMsg = repaired[1];
+    // Synthetic results must appear immediately after their server_tool_use,
+    // NOT after the tool_use block at the end
+    const blockTypes = assistantMsg.content.map((b) => b.type);
+    expect(blockTypes).toEqual([
+      "text",
+      "server_tool_use",
+      "web_search_tool_result", // right after stu_1
+      "server_tool_use",
+      "web_search_tool_result", // right after stu_2
+      "text",
+      "tool_use",
+    ]);
+
+    // Verify the pairings are correct
+    expect(
+      (assistantMsg.content[2] as { tool_use_id: string }).tool_use_id,
+    ).toBe("stu_1");
+    expect(
+      (assistantMsg.content[4] as { tool_use_id: string }).tool_use_id,
+    ).toBe("stu_2");
+  });
+
   test("downgrades type-mismatched tool_result for server_tool_use", () => {
     // A tool_result in the user message for a server_tool_use ID is orphaned —
     // server-side results belong in the assistant message

package/src/__tests__/host-file-read-tool.test.ts

@@ -8,6 +8,12 @@ import type { ToolContext } from "../tools/types.js";
 
 const testDirs: string[] = [];
 
+function makeTempDir(): string {
+  const dir = mkdtempSync(join(tmpdir(), "host-file-read-test-"));
+  testDirs.push(dir);
+  return dir;
+}
+
 function makeContext(): ToolContext {
   return {
     workingDir: "/tmp",
@@ -22,6 +28,18 @@ afterEach(() => {
   }
 });
 
+// Minimal valid JPEG: FF D8 FF E0 header
+const JPEG_HEADER = Buffer.from([
+  0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x49, 0x46, 0x00, 0x01, 0x01,
+  0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+]);
+
+// Minimal PNG header
+const PNG_HEADER = Buffer.from([
+  0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d, 0x49,
+  0x48, 0x44, 0x52,
+]);
+
 describe("host_file_read tool", () => {
   test("rejects relative paths", async () => {
     const result = await hostFileReadTool.execute(
@@ -145,3 +163,72 @@ describe("host_file_read tool", () => {
     expect(result.content).toContain("symlink-content");
   });
 });
+
+describe("host_file_read image support", () => {
+  test("returns image content block for .png file", async () => {
+    const dir = makeTempDir();
+    const filePath = join(dir, "screenshot.png");
+    writeFileSync(filePath, PNG_HEADER);
+
+    const result = await hostFileReadTool.execute(
+      { path: filePath },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Image loaded");
+    expect(result.content).toContain("image/png");
+    expect((result as any).contentBlocks).toBeDefined();
+    expect((result as any).contentBlocks[0].type).toBe("image");
+    expect((result as any).contentBlocks[0].source.media_type).toBe(
+      "image/png",
+    );
+  });
+
+  test("returns correct media type for .jpg file", async () => {
+    const dir = makeTempDir();
+    const filePath = join(dir, "photo.jpg");
+    writeFileSync(filePath, JPEG_HEADER);
+
+    const result = await hostFileReadTool.execute(
+      { path: filePath },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Image loaded");
+    expect(result.content).toContain("image/jpeg");
+    expect((result as any).contentBlocks).toBeDefined();
+    expect((result as any).contentBlocks[0].type).toBe("image");
+    expect((result as any).contentBlocks[0].source.media_type).toBe(
+      "image/jpeg",
+    );
+  });
+
+  test("returns error for non-existent image path", async () => {
+    const filePath = join(tmpdir(), `host-file-read-missing-${Date.now()}.png`);
+    const result = await hostFileReadTool.execute(
+      { path: filePath },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("file not found");
+  });
+
+  test("text file still works as before (regression)", async () => {
+    const dir = makeTempDir();
+    const filePath = join(dir, "notes.txt");
+    writeFileSync(filePath, "hello world\nsecond line\n");
+
+    const result = await hostFileReadTool.execute(
+      { path: filePath },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("1  hello world");
+    expect(result.content).toContain("2  second line");
+    expect((result as any).contentBlocks).toBeUndefined();
+  });
+});

package/src/__tests__/identity-intro-cache.test.ts

@@ -0,0 +1,209 @@
+/**
+ * Unit tests for the identity intro cache (identity-intro-cache.ts).
+ *
+ * Validates TTL-based expiration, content-hash-based invalidation when
+ * workspace identity files change, and round-trip get/set behavior.
+ */
+
+import { afterEach, describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Mocks — must be defined before importing the module under test
+// ---------------------------------------------------------------------------
+
+// Suppress logger output
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// In-memory checkpoint store
+const checkpointStore = new Map<string, string>();
+
+mock.module("../memory/checkpoints.js", () => ({
+  getMemoryCheckpoint: (key: string) => checkpointStore.get(key) ?? null,
+  setMemoryCheckpoint: (key: string, value: string) => {
+    checkpointStore.set(key, value);
+  },
+}));
+
+// Simulated workspace file contents
+const workspaceFiles: Record<string, string> = {};
+
+mock.module("../util/platform.js", () => ({
+  getWorkspacePromptPath: (name: string) => `/mock/workspace/${name}`,
+}));
+
+mock.module("node:fs", () => ({
+  existsSync: (path: string) => {
+    const name = path.split("/").pop() ?? "";
+    return name in workspaceFiles;
+  },
+  readFileSync: (path: string, _encoding: string) => {
+    const name = path.split("/").pop() ?? "";
+    if (name in workspaceFiles) return workspaceFiles[name];
+    throw new Error(`ENOENT: ${path}`);
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Imports (after mocks)
+// ---------------------------------------------------------------------------
+
+import {
+  computeIdentityContentHash,
+  getCachedIntro,
+  setCachedIntro,
+} from "../runtime/routes/identity-intro-cache.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+afterEach(() => {
+  checkpointStore.clear();
+  for (const key of Object.keys(workspaceFiles)) {
+    delete workspaceFiles[key];
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("identity intro cache", () => {
+  test("returns null when cache is empty", () => {
+    expect(getCachedIntro()).toBeNull();
+  });
+
+  test("round-trip: set then get returns cached text", () => {
+    workspaceFiles["IDENTITY.md"] = "- **Name:** Atlas";
+    workspaceFiles["SOUL.md"] = "Be playful.";
+    workspaceFiles["USER.md"] = "The user likes coffee.";
+
+    setCachedIntro("Hey, I'm Atlas.");
+    const cached = getCachedIntro();
+    expect(cached).not.toBeNull();
+    expect(cached!.text).toBe("Hey, I'm Atlas.");
+  });
+
+  test("returns null when cache is expired (TTL exceeded)", () => {
+    workspaceFiles["IDENTITY.md"] = "- **Name:** Atlas";
+
+    setCachedIntro("Hello!");
+
+    // Manually set the timestamp to 5 hours ago
+    const fiveHoursAgo = String(Date.now() - 5 * 60 * 60 * 1000);
+    checkpointStore.set("identity:intro:cached_at", fiveHoursAgo);
+
+    expect(getCachedIntro()).toBeNull();
+  });
+
+  test("returns cached text when within TTL (3 hours ago)", () => {
+    workspaceFiles["IDENTITY.md"] = "- **Name:** Atlas";
+
+    setCachedIntro("Hello!");
+
+    // Set timestamp to 3 hours ago (within 4-hour TTL)
+    const threeHoursAgo = String(Date.now() - 3 * 60 * 60 * 1000);
+    checkpointStore.set("identity:intro:cached_at", threeHoursAgo);
+
+    const cached = getCachedIntro();
+    expect(cached).not.toBeNull();
+    expect(cached!.text).toBe("Hello!");
+  });
+
+  test("busts cache when IDENTITY.md changes", () => {
+    workspaceFiles["IDENTITY.md"] = "- **Name:** Atlas";
+    setCachedIntro("I'm Atlas!");
+
+    // Change IDENTITY.md
+    workspaceFiles["IDENTITY.md"] = "- **Name:** Nova";
+
+    expect(getCachedIntro()).toBeNull();
+  });
+
+  test("busts cache when SOUL.md changes", () => {
+    workspaceFiles["SOUL.md"] = "Be playful.";
+    setCachedIntro("Hey there!");
+
+    // Change SOUL.md
+    workspaceFiles["SOUL.md"] = "Be serious and formal.";
+
+    expect(getCachedIntro()).toBeNull();
+  });
+
+  test("busts cache when USER.md changes", () => {
+    workspaceFiles["USER.md"] = "Likes coffee.";
+    setCachedIntro("Good morning!");
+
+    // Change USER.md
+    workspaceFiles["USER.md"] = "Likes tea.";
+
+    expect(getCachedIntro()).toBeNull();
+  });
+
+  test("cache survives when files are unchanged", () => {
+    workspaceFiles["IDENTITY.md"] = "- **Name:** Atlas";
+    workspaceFiles["SOUL.md"] = "Be chill.";
+    workspaceFiles["USER.md"] = "Likes sunsets.";
+
+    setCachedIntro("Atlas here.");
+
+    // Read twice — both should return the cached value
+    expect(getCachedIntro()?.text).toBe("Atlas here.");
+    expect(getCachedIntro()?.text).toBe("Atlas here.");
+  });
+
+  test("computeIdentityContentHash is deterministic", () => {
+    workspaceFiles["IDENTITY.md"] = "test";
+    workspaceFiles["SOUL.md"] = "test2";
+    workspaceFiles["USER.md"] = "test3";
+
+    const hash1 = computeIdentityContentHash();
+    const hash2 = computeIdentityContentHash();
+    expect(hash1).toBe(hash2);
+    expect(hash1).toMatch(/^[a-f0-9]{64}$/); // SHA-256 hex
+  });
+
+  test("computeIdentityContentHash changes when file content changes", () => {
+    workspaceFiles["IDENTITY.md"] = "v1";
+    const hash1 = computeIdentityContentHash();
+
+    workspaceFiles["IDENTITY.md"] = "v2";
+    const hash2 = computeIdentityContentHash();
+
+    expect(hash1).not.toBe(hash2);
+  });
+
+  test("handles missing workspace files gracefully", () => {
+    // No files exist — should still work (empty content hashed)
+    setCachedIntro("Hello!");
+    const cached = getCachedIntro();
+    expect(cached).not.toBeNull();
+    expect(cached!.text).toBe("Hello!");
+  });
+
+  test("returns null when text checkpoint is missing", () => {
+    checkpointStore.set("identity:intro:content_hash", "abc");
+    checkpointStore.set("identity:intro:cached_at", String(Date.now()));
+    // Missing text — should return null
+    expect(getCachedIntro()).toBeNull();
+  });
+
+  test("returns null when hash checkpoint is missing", () => {
+    checkpointStore.set("identity:intro:text", "Hello");
+    checkpointStore.set("identity:intro:cached_at", String(Date.now()));
+    // Missing hash — should return null
+    expect(getCachedIntro()).toBeNull();
+  });
+
+  test("returns null when timestamp checkpoint is missing", () => {
+    checkpointStore.set("identity:intro:text", "Hello");
+    checkpointStore.set("identity:intro:content_hash", "abc");
+    // Missing timestamp — should return null
+    expect(getCachedIntro()).toBeNull();
+  });
+});