@vellumai/assistant 0.5.0 → 0.5.2

package/src/__tests__/conversation-tool-setup-app-refresh.test.ts

@@ -2,11 +2,10 @@
  * Regression tests for app surface refresh and eventing side effects in
  * createToolExecutor (conversation-tool-setup.ts).
  *
- * After the App Builder tools source swap (PR 8), app tools like app_update,
- * app_file_edit, and app_file_write are provided by the app-builder skill
- * rather than core registration. The afterExecute hooks in createToolExecutor
- * fire based on tool *name* matching, so they must continue to work for
- * skill-origin tools. These tests verify that contract.
+ * The app_refresh hook is the sole hook for app change refresh. These tests
+ * verify that app_refresh, app_create, and app_delete hooks fire correctly,
+ * and that removed hooks (app_update, app_file_edit, app_file_write) no
+ * longer trigger side effects.
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
@@ -69,6 +68,7 @@ function makeCtx(overrides: Partial<ToolSetupContext> = {}): ToolSetupContext {
       { surfaceType: SurfaceType; data: SurfaceData; title?: string }
     >(),
     surfaceUndoStacks: new Map(),
+    accumulatedSurfaceState: new Map(),
     surfaceActionRequestIds: new Set<string>(),
     currentTurnSurfaces: [],
     isProcessing: () => false,
@@ -109,9 +109,9 @@ describe("session-tool-setup app refresh side effects", () => {
     updatePublishedSpy.mockClear();
   });
 
-  // ── app_update ──────────────────────────────────────────────────────
+  // ── app_refresh ─────────────────────────────────────────────────────
 
-  describe("app_update", () => {
+  describe("app_refresh", () => {
     test("triggers refreshSurfacesForApp when result is not an error", async () => {
       const ctx = makeCtx();
       const executor = makeFakeExecutor({
@@ -129,7 +129,7 @@ describe("session-tool-setup app refresh side effects", () => {
         broadcastSpy,
       );
 
-      await toolFn("app_update", { app_id: "app-1", name: "New Name" });
+      await toolFn("app_refresh", { app_id: "app-1" });
 
       expect(refreshSpy).toHaveBeenCalledTimes(1);
       expect((refreshSpy.mock.calls as unknown[][])[0][0]).toBe(ctx);
@@ -150,7 +150,7 @@ describe("session-tool-setup app refresh side effects", () => {
         broadcastSpy,
       );
 
-      await toolFn("app_update", { app_id: "app-42" });
+      await toolFn("app_refresh", { app_id: "app-42" });
 
       expect(broadcastSpy).toHaveBeenCalledTimes(1);
       expect((broadcastSpy.mock.calls as unknown[][])[0][0]).toEqual({
@@ -172,7 +172,7 @@ describe("session-tool-setup app refresh side effects", () => {
         mock(() => {}),
       );
 
-      await toolFn("app_update", { app_id: "app-publish" });
+      await toolFn("app_refresh", { app_id: "app-publish" });
 
       // updatePublishedAppDeployment is called with void (fire-and-forget),
       // so just verify it was invoked.
@@ -199,7 +199,7 @@ describe("session-tool-setup app refresh side effects", () => {
         broadcastSpy,
       );
 
-      await toolFn("app_update", { app_id: "app-err" });
+      await toolFn("app_refresh", { app_id: "app-err" });
 
       expect(refreshSpy).not.toHaveBeenCalled();
       expect(broadcastSpy).not.toHaveBeenCalled();
@@ -220,303 +220,13 @@ describe("session-tool-setup app refresh side effects", () => {
         broadcastSpy,
       );
 
-      await toolFn("app_update", {});
+      await toolFn("app_refresh", {});
 
       expect(refreshSpy).not.toHaveBeenCalled();
       expect(broadcastSpy).not.toHaveBeenCalled();
     });
   });
 
-  // ── app_file_edit ───────────────────────────────────────────────────
-
-  describe("app_file_edit", () => {
-    test("triggers refreshSurfacesForApp with fileChange flag", async () => {
-      const ctx = makeCtx();
-      const executor = makeFakeExecutor({
-        content: '{"ok":true}',
-        isError: false,
-      });
-      const broadcastSpy = mock(() => {});
-
-      const toolFn = createToolExecutor(
-        executor as unknown as ToolExecutor,
-        noopPrompter,
-        noopSecretPrompter,
-        ctx,
-        noopLifecycleHandler,
-        broadcastSpy,
-      );
-
-      await toolFn("app_file_edit", {
-        app_id: "app-edit",
-        path: "index.html",
-        old_string: "old",
-        new_string: "new",
-      });
-
-      expect(refreshSpy).toHaveBeenCalledTimes(1);
-      expect((refreshSpy.mock.calls as unknown[][])[0][1]).toBe("app-edit");
-      // Verify opts include fileChange: true
-      expect((refreshSpy.mock.calls as unknown[][])[0][2]).toEqual({
-        fileChange: true,
-        status: undefined,
-      });
-    });
-
-    test("propagates status field through refresh opts", async () => {
-      const ctx = makeCtx();
-      const executor = makeFakeExecutor({
-        content: '{"ok":true}',
-        isError: false,
-      });
-
-      const toolFn = createToolExecutor(
-        executor as unknown as ToolExecutor,
-        noopPrompter,
-        noopSecretPrompter,
-        ctx,
-        noopLifecycleHandler,
-        mock(() => {}),
-      );
-
-      await toolFn("app_file_edit", {
-        app_id: "app-status",
-        path: "styles.css",
-        old_string: "x",
-        new_string: "y",
-        status: "updating styles",
-      });
-
-      expect(refreshSpy).toHaveBeenCalledTimes(1);
-      expect((refreshSpy.mock.calls as unknown[][])[0][2]).toEqual({
-        fileChange: true,
-        status: "updating styles",
-      });
-    });
-
-    test("broadcasts app_files_changed for file edit", async () => {
-      const ctx = makeCtx();
-      const executor = makeFakeExecutor({ content: "{}", isError: false });
-      const broadcastSpy = mock(() => {});
-
-      const toolFn = createToolExecutor(
-        executor as unknown as ToolExecutor,
-        noopPrompter,
-        noopSecretPrompter,
-        ctx,
-        noopLifecycleHandler,
-        broadcastSpy,
-      );
-
-      await toolFn("app_file_edit", {
-        app_id: "app-edit-bc",
-        path: "f",
-        old_string: "a",
-        new_string: "b",
-      });
-
-      expect(broadcastSpy).toHaveBeenCalledTimes(1);
-      expect((broadcastSpy.mock.calls as unknown[][])[0][0]).toEqual({
-        type: "app_files_changed",
-        appId: "app-edit-bc",
-      });
-    });
-
-    test("calls updatePublishedAppDeployment for file edit", async () => {
-      const ctx = makeCtx();
-      const executor = makeFakeExecutor({ content: "{}", isError: false });
-
-      const toolFn = createToolExecutor(
-        executor as unknown as ToolExecutor,
-        noopPrompter,
-        noopSecretPrompter,
-        ctx,
-        noopLifecycleHandler,
-        mock(() => {}),
-      );
-
-      await toolFn("app_file_edit", {
-        app_id: "app-pub-edit",
-        path: "f",
-        old_string: "a",
-        new_string: "b",
-      });
-
-      expect(updatePublishedSpy).toHaveBeenCalledTimes(1);
-      expect((updatePublishedSpy.mock.calls as unknown[][])[0][0]).toBe(
-        "app-pub-edit",
-      );
-    });
-
-    test("skips side effects when result is an error", async () => {
-      const ctx = makeCtx();
-      const executor = makeFakeExecutor({ content: "Error", isError: true });
-      const broadcastSpy = mock(() => {});
-
-      const toolFn = createToolExecutor(
-        executor as unknown as ToolExecutor,
-        noopPrompter,
-        noopSecretPrompter,
-        ctx,
-        noopLifecycleHandler,
-        broadcastSpy,
-      );
-
-      await toolFn("app_file_edit", {
-        app_id: "app-err",
-        path: "f",
-        old_string: "a",
-        new_string: "b",
-      });
-
-      expect(refreshSpy).not.toHaveBeenCalled();
-      expect(broadcastSpy).not.toHaveBeenCalled();
-      expect(updatePublishedSpy).not.toHaveBeenCalled();
-    });
-  });
-
-  // ── app_file_write ──────────────────────────────────────────────────
-
-  describe("app_file_write", () => {
-    test("triggers refreshSurfacesForApp with fileChange flag", async () => {
-      const ctx = makeCtx();
-      const executor = makeFakeExecutor({
-        content: '{"written":true}',
-        isError: false,
-      });
-      const broadcastSpy = mock(() => {});
-
-      const toolFn = createToolExecutor(
-        executor as unknown as ToolExecutor,
-        noopPrompter,
-        noopSecretPrompter,
-        ctx,
-        noopLifecycleHandler,
-        broadcastSpy,
-      );
-
-      await toolFn("app_file_write", {
-        app_id: "app-write",
-        path: "new.html",
-        content: "<div/>",
-      });
-
-      expect(refreshSpy).toHaveBeenCalledTimes(1);
-      expect((refreshSpy.mock.calls as unknown[][])[0][1]).toBe("app-write");
-      expect((refreshSpy.mock.calls as unknown[][])[0][2]).toEqual({
-        fileChange: true,
-        status: undefined,
-      });
-    });
-
-    test("propagates status field through refresh opts", async () => {
-      const ctx = makeCtx();
-      const executor = makeFakeExecutor({
-        content: '{"written":true}',
-        isError: false,
-      });
-
-      const toolFn = createToolExecutor(
-        executor as unknown as ToolExecutor,
-        noopPrompter,
-        noopSecretPrompter,
-        ctx,
-        noopLifecycleHandler,
-        mock(() => {}),
-      );
-
-      await toolFn("app_file_write", {
-        app_id: "app-ws",
-        path: "f.txt",
-        content: "hi",
-        status: "adding dark mode",
-      });
-
-      expect(refreshSpy).toHaveBeenCalledTimes(1);
-      expect((refreshSpy.mock.calls as unknown[][])[0][2]).toEqual({
-        fileChange: true,
-        status: "adding dark mode",
-      });
-    });
-
-    test("broadcasts app_files_changed for file write", async () => {
-      const ctx = makeCtx();
-      const executor = makeFakeExecutor({ content: "{}", isError: false });
-      const broadcastSpy = mock(() => {});
-
-      const toolFn = createToolExecutor(
-        executor as unknown as ToolExecutor,
-        noopPrompter,
-        noopSecretPrompter,
-        ctx,
-        noopLifecycleHandler,
-        broadcastSpy,
-      );
-
-      await toolFn("app_file_write", {
-        app_id: "app-write-bc",
-        path: "f",
-        content: "x",
-      });
-
-      expect(broadcastSpy).toHaveBeenCalledTimes(1);
-      expect((broadcastSpy.mock.calls as unknown[][])[0][0]).toEqual({
-        type: "app_files_changed",
-        appId: "app-write-bc",
-      });
-    });
-
-    test("calls updatePublishedAppDeployment for file write", async () => {
-      const ctx = makeCtx();
-      const executor = makeFakeExecutor({ content: "{}", isError: false });
-
-      const toolFn = createToolExecutor(
-        executor as unknown as ToolExecutor,
-        noopPrompter,
-        noopSecretPrompter,
-        ctx,
-        noopLifecycleHandler,
-        mock(() => {}),
-      );
-
-      await toolFn("app_file_write", {
-        app_id: "app-pub-write",
-        path: "f",
-        content: "x",
-      });
-
-      expect(updatePublishedSpy).toHaveBeenCalledTimes(1);
-      expect((updatePublishedSpy.mock.calls as unknown[][])[0][0]).toBe(
-        "app-pub-write",
-      );
-    });
-
-    test("skips side effects when result is an error", async () => {
-      const ctx = makeCtx();
-      const executor = makeFakeExecutor({ content: "Error", isError: true });
-      const broadcastSpy = mock(() => {});
-
-      const toolFn = createToolExecutor(
-        executor as unknown as ToolExecutor,
-        noopPrompter,
-        noopSecretPrompter,
-        ctx,
-        noopLifecycleHandler,
-        broadcastSpy,
-      );
-
-      await toolFn("app_file_write", {
-        app_id: "app-err",
-        path: "f",
-        content: "x",
-      });
-
-      expect(refreshSpy).not.toHaveBeenCalled();
-      expect(broadcastSpy).not.toHaveBeenCalled();
-      expect(updatePublishedSpy).not.toHaveBeenCalled();
-    });
-  });
-
   // ── app_create side effects ─────────────────────────────────────────
 
   describe("app_create side effects", () => {
@@ -616,7 +326,7 @@ describe("session-tool-setup app refresh side effects", () => {
 
   describe("name-based hooks fire for skill-origin tools", () => {
     test("hooks fire purely on tool name, regardless of tool origin", async () => {
-      // The key invariant: createToolExecutor uses `name === 'app_update'`
+      // The key invariant: createToolExecutor uses `name === 'app_refresh'`
       // string comparison, not tool metadata or origin. This means skill-
       // projected tools with the same name trigger the same afterExecute
       // hooks as core tools.
@@ -633,22 +343,14 @@ describe("session-tool-setup app refresh side effects", () => {
         broadcastSpy,
       );
 
-      // Simulate calling each app tool by name (as the agent loop does)
-      for (const toolName of [
-        "app_update",
-        "app_file_edit",
-        "app_file_write",
-      ]) {
+      // Simulate calling app_refresh by name (as the agent loop does)
+      for (const toolName of ["app_refresh"]) {
         refreshSpy.mockClear();
         broadcastSpy.mockClear();
         updatePublishedSpy.mockClear();
 
         await toolFn(toolName, {
           app_id: "skill-app",
-          path: "f",
-          old_string: "a",
-          new_string: "b",
-          content: "x",
         });
 
         expect(refreshSpy).toHaveBeenCalledTimes(1);
@@ -675,7 +377,15 @@ describe("session-tool-setup app refresh side effects", () => {
         broadcastSpy,
       );
 
-      for (const toolName of ["read_file", "write_file", "shell", "app_list"]) {
+      for (const toolName of [
+        "read_file",
+        "write_file",
+        "shell",
+        "app_list",
+        "app_update",
+        "app_file_edit",
+        "app_file_write",
+      ]) {
         refreshSpy.mockClear();
         broadcastSpy.mockClear();
         updatePublishedSpy.mockClear();
@@ -706,7 +416,7 @@ describe("session-tool-setup app refresh side effects", () => {
       );
 
       // Should not throw even though broadcastToAllClients is undefined
-      const result = await toolFn("app_update", { app_id: "app-no-bc" });
+      const result = await toolFn("app_refresh", { app_id: "app-no-bc" });
 
       expect(result.isError).toBe(false);
       expect(refreshSpy).toHaveBeenCalledTimes(1);

package/src/__tests__/conversation-tool-setup-memory-scope.test.ts

@@ -56,6 +56,7 @@ function makeCtx(overrides: Partial<ToolSetupContext> = {}): ToolSetupContext {
       { surfaceType: SurfaceType; data: SurfaceData; title?: string }
     >(),
     surfaceUndoStacks: new Map(),
+    accumulatedSurfaceState: new Map(),
     surfaceActionRequestIds: new Set<string>(),
     currentTurnSurfaces: [],
     isProcessing: () => false,

package/src/__tests__/conversation-tool-setup-side-effect-flag.test.ts

@@ -56,6 +56,7 @@ function makeCtx(overrides: Partial<ToolSetupContext> = {}): ToolSetupContext {
       { surfaceType: SurfaceType; data: SurfaceData; title?: string }
     >(),
     surfaceUndoStacks: new Map(),
+    accumulatedSurfaceState: new Map(),
     surfaceActionRequestIds: new Set<string>(),
     currentTurnSurfaces: [],
     isProcessing: () => false,

package/src/__tests__/conversation-workspace-cache-state.test.ts

@@ -1,6 +1,10 @@
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { AgentEvent } from "../agent/loop.js";
+import { getConversationDirName } from "../memory/conversation-disk-view.js";
 import type { Message, ProviderResponse } from "../providers/types.js";
 
 // ---------------------------------------------------------------------------
@@ -79,6 +83,7 @@ mock.module("../memory/conversation-crud.js", () => ({
   getMessages: () => [],
   getConversation: () => ({
     id: "conv-1",
+    createdAt: Date.parse("2026-03-19T12:00:00.000Z"),
     contextSummary: null,
     contextCompactedMessageCount: 0,
     contextCompactedAt: null,
@@ -175,7 +180,7 @@ import { Conversation } from "../daemon/conversation.js";
 // Helpers
 // ---------------------------------------------------------------------------
 
-function makeConversation(): Conversation {
+function makeConversation(workingDir = "/tmp"): Conversation {
   const provider = {
     name: "mock",
     async sendMessage(): Promise<ProviderResponse> {
@@ -193,10 +198,17 @@ function makeConversation(): Conversation {
     "system prompt",
     4096,
     () => {},
-    "/tmp",
+    workingDir,
   );
 }
 
+const conversationDirName = getConversationDirName(
+  "conv-1",
+  Date.parse("2026-03-19T12:00:00.000Z"),
+);
+const conversationPath = `conversations/${conversationDirName}/`;
+const conversationAttachmentsPath = `${conversationPath}attachments/`;
+
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
@@ -224,6 +236,12 @@ describe("Conversation workspace cache state", () => {
     expect(conversation.getWorkspaceTopLevelContext()!).toContain(
       "</workspace_top_level>",
     );
+    expect(conversation.getWorkspaceTopLevelContext()!).toContain(
+      `Current conversation folder: ${conversationPath}`,
+    );
+    expect(conversation.getWorkspaceTopLevelContext()!).toContain(
+      `Attachment files: ${conversationAttachmentsPath}`,
+    );
   });
 
   test("refreshWorkspaceTopLevelContextIfNeeded no-ops when not dirty and cache exists", () => {
@@ -257,4 +275,28 @@ describe("Conversation workspace cache state", () => {
     );
     expect(conversation.isWorkspaceTopLevelDirty()).toBe(false);
   });
+
+  test("workspace hints follow the resolved legacy directory when canonical is absent", () => {
+    const workspaceRoot = mkdtempSync(
+      join(tmpdir(), "conversation-workspace-cache-state-"),
+    );
+    const legacyDirName = `conv-1_2026-03-19T12-00-00.000Z`;
+    mkdirSync(join(workspaceRoot, "conversations", legacyDirName), {
+      recursive: true,
+    });
+
+    try {
+      const tempConversation = makeConversation(workspaceRoot);
+      tempConversation.refreshWorkspaceTopLevelContextIfNeeded();
+
+      expect(tempConversation.getWorkspaceTopLevelContext()!).toContain(
+        `Current conversation folder: conversations/${legacyDirName}/`,
+      );
+      expect(tempConversation.getWorkspaceTopLevelContext()!).toContain(
+        `Attachment files: conversations/${legacyDirName}/attachments/`,
+      );
+    } finally {
+      rmSync(workspaceRoot, { recursive: true, force: true });
+    }
+  });
 });

package/src/__tests__/conversation-workspace-injection.test.ts

@@ -1,6 +1,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { AgentEvent } from "../agent/loop.js";
+import { getConversationDirName } from "../memory/conversation-disk-view.js";
 import type { Message, ProviderResponse } from "../providers/types.js";
 
 // ---------------------------------------------------------------------------
@@ -115,6 +116,7 @@ mock.module("../memory/conversation-crud.js", () => ({
   getMessages: () => [],
   getConversation: () => ({
     id: "conv-1",
+    createdAt: Date.parse("2026-03-19T12:00:00.000Z"),
     contextSummary: null,
     contextCompactedMessageCount: 0,
     contextCompactedAt: null,
@@ -277,6 +279,13 @@ function messageText(message: Message): string {
     .join("\n");
 }
 
+const conversationDirName = getConversationDirName(
+  "conv-1",
+  Date.parse("2026-03-19T12:00:00.000Z"),
+);
+const conversationPath = `conversations/${conversationDirName}/`;
+const conversationAttachmentsPath = `${conversationPath}attachments/`;
+
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
@@ -312,6 +321,8 @@ describe("Conversation workspace injection", () => {
     const runtimeUser = runCalls[0][runCalls[0].length - 1];
     const text = messageText(runtimeUser);
     expect(text).toContain("Root: /tmp");
+    expect(text).toContain(`Current conversation folder: ${conversationPath}`);
+    expect(text).toContain(`Attachment files: ${conversationAttachmentsPath}`);
   });
 
   test("workspace context is prepended before user text", async () => {

package/src/__tests__/credential-execution-feature-gates.test.ts

@@ -154,16 +154,16 @@ describe("CES flags do not affect unrelated flags", () => {
     ).toBe(true);
   });
 
-  test("enabling all CES flags does not change contacts flag (defaultEnabled: false)", () => {
+  test("enabling all CES flags does not change contacts flag (defaultEnabled: true)", () => {
     const overrides: Record<string, boolean> = {};
     for (const key of ALL_CES_FLAG_KEYS) {
       overrides[key] = true;
     }
     const config = makeConfig(overrides);
 
-    // contacts defaults to false in the registry and should stay false
+    // contacts defaults to true in the registry and should stay true
     expect(
       isAssistantFeatureFlagEnabled("feature_flags.contacts.enabled", config),
-    ).toBe(false);
+    ).toBe(true);
   });
 });

package/src/__tests__/credential-security-invariants.test.ts

@@ -251,6 +251,9 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "tools/claude-code/claude-code.ts", // Claude Code tool API key lookup
       "workspace/migrations/006-services-config.ts", // services config migration reads provider API keys
       "cli/commands/avatar.ts", // CLI avatar generation API key lookup
+      "config/bundled-skills/slack/tools/shared.ts", // Slack skill bot token lookup
+      "daemon/conversation-process.ts", // masked provider key display
+      "daemon/handlers/config-model.ts", // masked provider key display
     ]);
 
     const thisDir = dirname(fileURLToPath(import.meta.url));

package/src/__tests__/credential-vault-unit.test.ts

@@ -102,13 +102,10 @@ mock.module("../daemon/handlers/config-slack-channel.js", () => ({
     slackChannelConfigCalls.push({ botToken, appToken });
 
     const { credentialKey } = await import("../security/credential-key.js");
-    const {
-      getSecureKeyAsync,
-      setSecureKeyAsync,
-    } = await import("../security/secure-keys.js");
-    const { upsertCredentialMetadata } = await import(
-      "../tools/credentials/metadata-store.js"
-    );
+    const { getSecureKeyAsync, setSecureKeyAsync } =
+      await import("../security/secure-keys.js");
+    const { upsertCredentialMetadata } =
+      await import("../tools/credentials/metadata-store.js");
 
     const hasExistingBotToken = !!(await getSecureKeyAsync(
       credentialKey("slack_channel", "bot_token"),
@@ -646,9 +643,7 @@ describe("credential_store tool — prompt action", () => {
     );
     expect(appResult.isError).toBe(false);
     expect(manualConnectionStore["slack_channel"]).toBeUndefined();
-    expect(slackChannelConfigCalls).toEqual([
-      { appToken: "xapp-test-token" },
-    ]);
+    expect(slackChannelConfigCalls).toEqual([{ appToken: "xapp-test-token" }]);
     expect(appResult.content).toContain("connection incomplete");
 
     const botResult = await credentialStoreTool.execute(

package/src/__tests__/cu-unified-flow.test.ts

@@ -30,6 +30,7 @@ function buildMockContext(
     lastSurfaceAction: new Map(),
     surfaceState: new Map(),
     surfaceUndoStacks: new Map(),
+    accumulatedSurfaceState: new Map(),
     surfaceActionRequestIds: new Set(),
     currentTurnSurfaces: [],
     hostCuProxy,