@vellumai/assistant 0.4.9 → 0.4.11

package/src/__tests__/host-shell-tool.test.ts

@@ -74,6 +74,7 @@ function makeContext(): ToolContext {
     workingDir: '/tmp',
     sessionId: 'test-session',
     conversationId: 'test-conversation',
+    guardianTrustClass: 'guardian',
   };
 }
 

package/src/__tests__/lifecycle-docs-guard.test.ts

@@ -0,0 +1,207 @@
+import { execSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { describe, expect, it } from 'bun:test';
+
+/**
+ * Guard test: prevent stale lifecycle instructions from being reintroduced
+ * into documentation. The canonical lifecycle commands are `vellum wake`,
+ * `vellum ps`, and `vellum sleep`. Repo-local slash commands live in
+ * `.claude/skills/`, not `.claude/commands/`.
+ *
+ * See AGENTS.md for the conventions these tests enforce.
+ */
+
+const REPO_ROOT = join(import.meta.dir, '../../..');
+
+describe('lifecycle docs guard', () => {
+  it('repo-local commands live in skills directory, not commands directory', () => {
+    const staleLocations = [
+      '.claude/commands/update.md',
+      '.claude/commands/release.md',
+    ];
+
+    const violations = staleLocations.filter((p) =>
+      existsSync(join(REPO_ROOT, p)),
+    );
+
+    if (violations.length > 0) {
+      const message = [
+        'Found repo-local commands in .claude/commands/ — they should live in .claude/skills/.',
+        '',
+        'Stale files:',
+        ...violations.map((f) => `  - ${f}`),
+        '',
+        'Move them to .claude/skills/<name>/SKILL.md instead.',
+      ].join('\n');
+
+      expect(violations, message).toEqual([]);
+    }
+
+    // Verify the correct locations exist
+    const expectedLocations = [
+      '.claude/skills/update/SKILL.md',
+      '.claude/skills/release/SKILL.md',
+    ];
+
+    const missing = expectedLocations.filter(
+      (p) => !existsSync(join(REPO_ROOT, p)),
+    );
+
+    if (missing.length > 0) {
+      const message = [
+        'Expected repo-local skill files are missing:',
+        ...missing.map((f) => `  - ${f}`),
+      ].join('\n');
+
+      expect(missing, message).toEqual([]);
+    }
+  });
+
+  it('key docs reference vellum lifecycle commands', () => {
+    const checks: Array<{
+      file: string;
+      pattern: string;
+      description: string;
+    }> = [
+      {
+        file: 'README.md',
+        pattern: 'vellum wake\\|vellum ps\\|vellum sleep',
+        description:
+          'README.md should mention vellum wake, vellum ps, or vellum sleep',
+      },
+      {
+        file: 'assistant/README.md',
+        pattern: 'vellum wake\\|vellum ps',
+        description:
+          'assistant/README.md should mention vellum wake or vellum ps',
+      },
+      {
+        file: 'AGENTS.md',
+        pattern: 'vellum ps\\|vellum sleep\\|vellum wake',
+        description:
+          'AGENTS.md should mention vellum ps, vellum sleep, or vellum wake in the /update command description',
+      },
+    ];
+
+    const failures: string[] = [];
+
+    for (const check of checks) {
+      try {
+        execSync(`git grep -q '${check.pattern}' -- '${check.file}'`, {
+          encoding: 'utf-8',
+          cwd: REPO_ROOT,
+        });
+      } catch {
+        failures.push(check.description);
+      }
+    }
+
+    if (failures.length > 0) {
+      const message = [
+        'Key docs are missing vellum lifecycle command references:',
+        '',
+        ...failures.map((f) => `  - ${f}`),
+        '',
+        'These docs should reference vellum CLI lifecycle commands (wake/ps/sleep).',
+      ].join('\n');
+
+      expect(failures, message).toEqual([]);
+    }
+  });
+
+  it('no docs use stale daemon startup as primary instruction', () => {
+    // Files that are allowed to contain these patterns
+    const allowedPrefixes = [
+      'cli/', // CLI source code
+      'assistant/src/', // assistant runtime source
+      'CLAUDE.md', // project instructions
+      'AGENTS.md', // agent conventions (may reference patterns for context)
+    ];
+
+    const stalePatterns = [
+      {
+        pattern: 'bun run src/index.ts daemon start',
+        label: 'bun run src/index.ts daemon start',
+      },
+    ];
+
+    const violations: string[] = [];
+
+    for (const { pattern, label } of stalePatterns) {
+      let grepOutput = '';
+      try {
+        grepOutput = execSync(
+          `git grep -n '${pattern}' -- '*.md'`,
+          { encoding: 'utf-8', cwd: REPO_ROOT },
+        ).trim();
+      } catch {
+        // No matches — happy path
+        continue;
+      }
+
+      const lines = grepOutput.split('\n').filter((l) => l.length > 0);
+
+      for (const line of lines) {
+        const filePath = line.split(':')[0];
+
+        // Skip allowed file prefixes
+        if (allowedPrefixes.some((prefix) => filePath.startsWith(prefix))) {
+          continue;
+        }
+
+        // Skip test files
+        if (filePath.includes('__tests__') || filePath.endsWith('.test.ts')) {
+          continue;
+        }
+
+        // Check if this specific occurrence is inside a <details> section or
+        // a "Development" / "raw bun commands" context by examining only the
+        // 10 lines before this match. We extract the line number from the
+        // grep output (format "filePath:lineNum:content") and use sed to
+        // get a targeted range, so each match is evaluated independently.
+        const parts = line.split(':');
+        const lineNum = parseInt(parts[1], 10);
+
+        if (!Number.isNaN(lineNum)) {
+          try {
+            const startLine = Math.max(1, lineNum - 10);
+            const context = execSync(
+              `sed -n '${startLine},${lineNum}p' '${filePath}'`,
+              { encoding: 'utf-8', cwd: REPO_ROOT },
+            );
+
+            const contextLower = context.toLowerCase();
+            const isInDetails = contextLower.includes('<details>');
+            const isDevContext =
+              contextLower.includes('development:') ||
+              contextLower.includes('low-level development') ||
+              contextLower.includes('raw bun commands');
+
+            if (isInDetails || isDevContext) {
+              continue;
+            }
+          } catch {
+            // If context extraction fails, treat as a violation
+          }
+        }
+
+        violations.push(`${filePath}: contains "${label}" as primary instruction`);
+      }
+    }
+
+    if (violations.length > 0) {
+      const message = [
+        'Found docs using stale daemon startup patterns as primary instructions.',
+        'Use `vellum wake` / `vellum sleep` instead. Raw bun commands are acceptable',
+        'only in collapsed <details> sections or dev-only contexts.',
+        '',
+        'Violations:',
+        ...violations.map((v) => `  - ${v}`),
+      ].join('\n');
+
+      expect(violations, message).toEqual([]);
+    }
+  });
+});

package/src/__tests__/managed-skill-lifecycle.test.ts

@@ -84,6 +84,7 @@ function makeContext(): ToolContext {
     workingDir: '/tmp',
     sessionId: 'test-session',
     conversationId: 'test-conversation',
+    guardianTrustClass: 'guardian',
   };
 }
 

package/src/__tests__/media-reuse-story.e2e.test.ts

@@ -235,6 +235,7 @@ describe('Story E2E: selfie yesterday -> generated image today', () => {
       workingDir: sandboxDir,
       sessionId: 'sess-story',
       conversationId: threadB.id,
+      guardianTrustClass: 'guardian',
     };
 
     const result = await assetSearchTool.execute(
@@ -253,6 +254,7 @@ describe('Story E2E: selfie yesterday -> generated image today', () => {
       workingDir: sandboxDir,
       sessionId: 'sess-story',
       conversationId: threadB.id,
+      guardianTrustClass: 'guardian',
     };
 
     const result = await assetSearchTool.execute(
@@ -269,6 +271,7 @@ describe('Story E2E: selfie yesterday -> generated image today', () => {
       workingDir: sandboxDir,
       sessionId: 'sess-story',
       conversationId: threadB.id,
+      guardianTrustClass: 'guardian',
     };
 
     const result = await assetMaterializeTool.execute(
@@ -296,6 +299,7 @@ describe('Story E2E: selfie yesterday -> generated image today', () => {
       workingDir: sandboxDir,
       sessionId: 'sess-story',
       conversationId: threadB.id,
+      guardianTrustClass: 'guardian',
     };
 
     // Step 3a: Search for the selfie
@@ -486,6 +490,7 @@ describe('Private-thread variant: cross-thread media blocking', () => {
       workingDir: sandboxDir,
       sessionId: 'sess-priv-test',
       conversationId: standardThread.id,
+      guardianTrustClass: 'guardian',
     };
 
     const result = await assetSearchTool.execute(
@@ -510,6 +515,7 @@ describe('Private-thread variant: cross-thread media blocking', () => {
       workingDir: sandboxDir,
       sessionId: 'sess-priv-test',
       conversationId: standardThread.id,
+      guardianTrustClass: 'guardian',
     };
 
     const result = await assetMaterializeTool.execute(
@@ -533,6 +539,7 @@ describe('Private-thread variant: cross-thread media blocking', () => {
       workingDir: sandboxDir,
       sessionId: 'sess-priv-test',
       conversationId: privateThread.id,
+      guardianTrustClass: 'guardian',
     };
 
     const searchResult = await assetSearchTool.execute(
@@ -563,6 +570,7 @@ describe('Private-thread variant: cross-thread media blocking', () => {
       workingDir: sandboxDir,
       sessionId: 'sess-priv-test',
       conversationId: privateThreadB.id,
+      guardianTrustClass: 'guardian',
     };
 
     const searchResult = await assetSearchTool.execute(

package/src/__tests__/messaging-send-tool.test.ts

@@ -48,6 +48,7 @@ describe('messaging-send tool', () => {
         sessionId: 'sess-1',
         conversationId: 'conv-1',
         assistantId: 'ast-alpha',
+        guardianTrustClass: 'guardian' as const,
       },
     );
 

package/src/__tests__/playbook-execution.test.ts

@@ -69,6 +69,7 @@ const ctx: ToolContext = {
   workingDir: '/tmp',
   sessionId: 'test-session',
   conversationId: 'test-conversation',
+  guardianTrustClass: 'guardian',
 };
 
 function insertPlaybookRow(overrides: Partial<{

package/src/__tests__/playbook-tools.test.ts

@@ -61,6 +61,7 @@ const ctx: ToolContext = {
   workingDir: '/tmp',
   sessionId: 'test-session',
   conversationId: 'test-conversation',
+  guardianTrustClass: 'guardian',
 };
 
 function clearPlaybooks(): void {

package/src/__tests__/relay-server.test.ts

@@ -1277,6 +1277,7 @@ describe('relay-server', () => {
       channel: 'voice',
       guardianExternalUserId: '+15550001111',
       guardianDeliveryChatId: '+15550001111',
+      guardianPrincipalId: '+15550001111',
     });
 
     mockSendMessage.mockImplementation(createMockProviderResponse(['Hello there.']));
@@ -1313,6 +1314,7 @@ describe('relay-server', () => {
       channel: 'voice',
       guardianExternalUserId: '+15550009999',
       guardianDeliveryChatId: '+15550009999',
+      guardianPrincipalId: '+15550009999',
     });
     addTrustedVoiceContact('+15550002222', 'self');
 
@@ -1360,6 +1362,7 @@ describe('relay-server', () => {
       channel: 'voice',
       guardianExternalUserId: '+15550001111',
       guardianDeliveryChatId: '+15550001111',
+      guardianPrincipalId: '+15550001111',
     });
 
     mockSendMessage.mockImplementation(createMockProviderResponse(['Hello there.']));
@@ -1404,6 +1407,7 @@ describe('relay-server', () => {
       channel: 'telegram',
       guardianExternalUserId: 'tg-guardian-user',
       guardianDeliveryChatId: 'tg-guardian-chat',
+      guardianPrincipalId: 'tg-guardian-user',
     });
 
     // Number matches the configured owner number, but there is no active

package/src/__tests__/scaffold-managed-skill-tool.test.ts

@@ -30,6 +30,7 @@ function makeContext(): ToolContext {
     workingDir: '/tmp',
     sessionId: 'test-session',
     conversationId: 'test-conversation',
+    guardianTrustClass: 'guardian',
   };
 }
 

package/src/__tests__/schedule-tools.test.ts

@@ -56,6 +56,7 @@ const ctx: ToolContext = {
   workingDir: '/tmp',
   sessionId: 'test-session',
   conversationId: 'test-conversation',
+  guardianTrustClass: 'guardian',
 };
 
 // ── schedule_create ─────────────────────────────────────────────────

package/src/__tests__/secret-onetime-send.test.ts

@@ -61,6 +61,7 @@ describe('one-time send override', () => {
       workingDir: '/tmp',
       sessionId: 's1',
       conversationId: 'c1',
+      guardianTrustClass: 'guardian' as const,
       requestSecret: async () => ({ value: 'v1', delivery: 'transient_send' as const }),
     };
 
@@ -80,6 +81,7 @@ describe('one-time send override', () => {
       workingDir: '/tmp',
       sessionId: 's1',
       conversationId: 'c1',
+      guardianTrustClass: 'guardian' as const,
       requestSecret: async () => ({ value: 'v1', delivery: 'transient_send' as const }),
     };
 
@@ -99,6 +101,7 @@ describe('one-time send override', () => {
       workingDir: '/tmp',
       sessionId: 's1',
       conversationId: 'c1',
+      guardianTrustClass: 'guardian' as const,
       requestSecret: async () => ({ value: 'v1', delivery: 'store' as const }),
     };
 
@@ -118,6 +121,7 @@ describe('one-time send override', () => {
       workingDir: '/tmp',
       sessionId: 's1',
       conversationId: 'c1',
+      guardianTrustClass: 'guardian' as const,
       requestSecret: async () => ({ value: secretVal, delivery: 'transient_send' as const }),
     };
 

package/src/__tests__/secret-scanner-executor.test.ts

@@ -95,6 +95,7 @@ function makeContext(overrides?: Partial<{
     workingDir: '/tmp',
     sessionId: 'test-session',
     conversationId: 'test-conversation',
+    guardianTrustClass: 'guardian' as const,
     onToolLifecycleEvent: (event: ToolLifecycleEvent) => {
       auditListener(event);
       return overrides?.onToolLifecycleEvent?.(event);
@@ -313,6 +314,7 @@ describe('Secret scanner executor integration', () => {
       workingDir: '/tmp',
       sessionId: 'test-session',
       conversationId: 'test-conversation',
+      guardianTrustClass: 'guardian' as const,
     };
 
     const result = await executor.execute('file_read', {}, ctx);

package/src/__tests__/send-notification-tool.test.ts

@@ -33,6 +33,7 @@ describe('send-notification tool', () => {
         sessionId: 'sess-1',
         conversationId: 'conv-1',
         assistantId: 'ast-alpha',
+        guardianTrustClass: 'guardian' as const,
       },
     );
 
@@ -76,6 +77,7 @@ describe('send-notification tool', () => {
         sessionId: 'sess-1',
         conversationId: 'conv-1',
         assistantId: 'ast-alpha',
+        guardianTrustClass: 'guardian' as const,
       },
     );
 

package/src/__tests__/shell-credential-ref.test.ts

@@ -77,6 +77,7 @@ const ctx: ToolContext = {
   workingDir: '/tmp',
   sessionId: 'test-session',
   conversationId: 'test-conv',
+  guardianTrustClass: 'guardian',
 };
 
 beforeEach(() => {

package/src/__tests__/shell-tool-proxy-mode.test.ts

@@ -127,6 +127,7 @@ function makeContext(overrides?: Partial<ToolContext>): ToolContext {
     workingDir: '/tmp',
     sessionId: 'test-session',
     conversationId: 'test-conv',
+    guardianTrustClass: 'guardian',
     ...overrides,
   };
 }

package/src/__tests__/skill-load-feature-flag.test.ts

@@ -81,6 +81,7 @@ async function executeSkillLoad(input: Record<string, unknown>): Promise<{ conte
     workingDir: '/tmp',
     sessionId: 'session-1',
     conversationId: 'conversation-1',
+    guardianTrustClass: 'guardian',
   });
   return { content: result.content, isError: result.isError };
 }

package/src/__tests__/skill-load-tool.test.ts

@@ -76,6 +76,7 @@ async function executeSkillLoad(input: Record<string, unknown>): Promise<{ conte
     workingDir: '/tmp',
     sessionId: 'session-1',
     conversationId: 'conversation-1',
+    guardianTrustClass: 'guardian',
   });
   return { content: result.content, isError: result.isError };
 }

package/src/__tests__/skill-script-runner-host.test.ts

@@ -17,6 +17,7 @@ function makeContext(overrides: Partial<ToolContext> = {}): ToolContext {
     workingDir: '/tmp',
     sessionId: 'test-session',
     conversationId: 'test-conversation',
+    guardianTrustClass: 'guardian',
     ...overrides,
   };
 }

package/src/__tests__/skill-script-runner-sandbox.test.ts

@@ -63,6 +63,7 @@ function makeContext(overrides: Partial<ToolContext> = {}): ToolContext {
     workingDir: '/tmp',
     sessionId: 'test-session',
     conversationId: 'test-conversation',
+    guardianTrustClass: 'guardian',
     ...overrides,
   };
 }

package/src/__tests__/skill-script-runner.test.ts

@@ -17,6 +17,7 @@ const ctx: ToolContext = {
   workingDir: '/tmp',
   sessionId: 'test-session',
   conversationId: 'test-conversation',
+  guardianTrustClass: 'guardian',
 };
 
 function makeSkillDir(name: string): string {

package/src/__tests__/skill-tool-factory.test.ts

@@ -36,6 +36,7 @@ function makeContext(overrides: Partial<ToolContext> = {}): ToolContext {
     workingDir: '/tmp',
     sessionId: 'test-session',
     conversationId: 'test-conversation',
+    guardianTrustClass: 'guardian',
     ...overrides,
   };
 }

package/src/__tests__/subagent-tools.test.ts

@@ -88,7 +88,7 @@ function injectSubagent(
 }
 
 function makeContext(sessionId: string, extras: Record<string, unknown> = {}) {
-  return { workingDir: '/tmp', sessionId, conversationId: 'conv-1', ...extras };
+  return { workingDir: '/tmp', sessionId, conversationId: 'conv-1', guardianTrustClass: 'guardian' as const, ...extras } as import('../tools/types.js').ToolContext;
 }
 
 // ── Tool definitions ────────────────────────────────────────────────

package/src/__tests__/swarm-recursion.test.ts

@@ -87,6 +87,7 @@ function makeContext(overrides?: Partial<ToolContext>): ToolContext {
     sessionId: 'test-session',
     conversationId: 'test-conv',
     workingDir: '/tmp/test',
+    guardianTrustClass: 'guardian',
     onOutput: () => {},
     ...overrides,
   } as ToolContext;

package/src/__tests__/swarm-session-integration.test.ts

@@ -79,6 +79,7 @@ function makeContext(overrides?: Partial<ToolContext>): ToolContext {
     sessionId: 'test-session',
     conversationId: 'test-conv',
     workingDir: '/tmp/test',
+    guardianTrustClass: 'guardian',
     onOutput: () => {},
     ...overrides,
   } as ToolContext;

package/src/__tests__/swarm-tool.test.ts

@@ -74,6 +74,7 @@ function makeContext(overrides?: Partial<ToolContext>): ToolContext {
   return {
     sessionId: 'test-session',
     workingDir: '/tmp/test',
+    guardianTrustClass: 'guardian',
     onOutput: () => {},
     ...overrides,
   } as ToolContext;

package/src/__tests__/task-management-tools.test.ts

@@ -62,6 +62,7 @@ const ctx: ToolContext = {
   workingDir: '/tmp',
   sessionId: 'test-session',
   conversationId: 'test-conversation',
+  guardianTrustClass: 'guardian',
 };
 
 function clearTables() {

package/src/__tests__/task-tools.test.ts

@@ -84,6 +84,7 @@ const stubContext: ToolContext = {
   workingDir: '/tmp',
   sessionId: 'test-session',
   conversationId: 'test-conversation',
+  guardianTrustClass: 'guardian',
 };
 
 // ── task_save ────────────────────────────────────────────────────────

package/src/__tests__/terminal-tools.test.ts

@@ -573,6 +573,7 @@ describe('Shell tool input validation', () => {
     workingDir: testTmpDir,
     sessionId: 'test-session-1',
     conversationId: 'test-conv-1',
+    guardianTrustClass: 'guardian' as const,
     onOutput: () => {},
   };
 

package/src/__tests__/tool-approval-handler.test.ts

@@ -286,11 +286,11 @@ describe('ToolApprovalHandler / pre-exec gate grant check', () => {
     expect(result.allowed).toBe(true);
   });
 
-  test('undefined actor role (desktop) bypasses grant check', async () => {
+  test('guardian actor role (desktop) bypasses grant check', async () => {
     const toolName = 'bash';
     const input = { command: 'deploy' };
 
-    const context = makeContext({ guardianTrustClass: undefined });
+    const context = makeContext({ guardianTrustClass: 'guardian' });
     const result = await handler.checkPreExecutionGates(
       toolName, input, context, 'host', 'high', Date.now(), emitLifecycleEvent,
     );

package/src/__tests__/tool-execution-abort-cleanup.test.ts

@@ -101,6 +101,7 @@ function makeToolContext(workingDir: string, signal?: AbortSignal) {
     workingDir,
     sessionId: 'test-session',
     conversationId: 'test-conv',
+    guardianTrustClass: 'guardian' as const,
     signal,
   };
 }

package/src/__tests__/tool-execution-pipeline.benchmark.test.ts

@@ -403,6 +403,7 @@ describe('Tool execution pipeline benchmark', () => {
       workingDir: '/tmp',
       sessionId: 'bench-session',
       conversationId: 'bench-conv',
+      guardianTrustClass: 'guardian',
     };
 
     function makeTool(name: string, sleepMs: number): Tool {

package/src/__tests__/tool-executor-lifecycle-events.test.ts

@@ -138,6 +138,7 @@ function makeContext(events: ToolLifecycleEvent[]) {
     workingDir: '/tmp/project',
     sessionId: 'session-1',
     conversationId: 'conversation-1',
+    guardianTrustClass: 'guardian' as const,
     onToolLifecycleEvent: (event: ToolLifecycleEvent) => {
       events.push(event);
     },
@@ -424,6 +425,7 @@ describe('ToolExecutor lifecycle events', () => {
       workingDir: '/tmp/project',
       sessionId: 'session-1',
       conversationId: 'conversation-1',
+      guardianTrustClass: 'guardian',
       onToolLifecycleEvent: () => new Promise<void>(() => {}),
     });
 

package/src/__tests__/tool-executor-shell-integration.test.ts

@@ -125,6 +125,7 @@ function makeContext(overrides?: Partial<ToolContext>): ToolContext {
     workingDir: '/tmp/project',
     sessionId: 'session-integration',
     conversationId: 'conversation-integration',
+    guardianTrustClass: 'guardian',
     ...overrides,
   };
 }

package/src/__tests__/tool-executor.test.ts

@@ -106,6 +106,7 @@ function makeContext(overrides?: Partial<ToolContext>): ToolContext {
     workingDir: '/tmp/project',
     sessionId: 'session-1',
     conversationId: 'conversation-1',
+    guardianTrustClass: 'guardian',
     ...overrides,
   };
 }