@vellumai/assistant 0.5.1 → 0.5.2

package/src/__tests__/memory-recall-quality.test.ts

@@ -287,7 +287,7 @@ describe("Memory Recall Quality", () => {
     test("preferences are recalled when querying about user preferences", async () => {
       const db = getDb();
       const now = 1_700_000_000_000;
-      insertConversation(db, "conv-pref", now);
+      insertConversation(db, "conv-pref", now, 3);
       insertMessage(
         db,
         "msg-pref-1",
@@ -408,7 +408,7 @@ describe("Memory Recall Quality", () => {
     test("high-importance preferences outrank low-importance facts in recall", async () => {
       const db = getDb();
       const now = 1_700_000_100_000;
-      insertConversation(db, "conv-rank", now);
+      insertConversation(db, "conv-rank", now, 2);
 
       // High-importance preference
       insertMessage(
@@ -692,7 +692,7 @@ describe("Memory Recall Quality", () => {
       const db = getDb();
       const now = Date.now();
       const oneMonthAgo = now - 30 * 24 * 60 * 60 * 1000;
-      insertConversation(db, "conv-stale", now);
+      insertConversation(db, "conv-stale", now, 2);
 
       // Recent mention
       insertMessage(
@@ -774,7 +774,7 @@ describe("Memory Recall Quality", () => {
     test("frequently accessed items surface via recency search when seeded with segments", async () => {
       const db = getDb();
       const now = 1_700_000_400_000;
-      insertConversation(db, "conv-access", now);
+      insertConversation(db, "conv-access", now, 2);
 
       // Frequently accessed item with segment
       insertMessage(
@@ -885,7 +885,7 @@ describe("Memory Recall Quality", () => {
     test("recency search surfaces segments when hybrid search is unavailable", async () => {
       const db = getDb();
       const now = 1_700_000_500_000;
-      insertConversation(db, "conv-multi", now);
+      insertConversation(db, "conv-multi", now, 1);
 
       // Segment (recency source)
       insertMessage(

package/src/__tests__/migration-cross-version-compatibility.test.ts

@@ -894,7 +894,10 @@ describe("partial failure scenarios", () => {
     const blockerWorkspace = join(testDir, "blocker-workspace");
     mkdirSync(blockerWorkspace, { recursive: true });
     // Create "data" as a regular file — mkdirSync("data/db") will fail
-    writeFileSync(join(blockerWorkspace, "data"), "I am a file, not a directory");
+    writeFileSync(
+      join(blockerWorkspace, "data"),
+      "I am a file, not a directory",
+    );
 
     const resolver = new DefaultPathResolver(undefined, blockerWorkspace);
     const result = commitImport({

package/src/__tests__/migration-export-http.test.ts

@@ -299,7 +299,9 @@ describe("export data population", () => {
     const archiveData = new Uint8Array(await res.arrayBuffer());
     const entries = parseTarEntries(archiveData);
 
-    const dbEntry = entries.find((e) => e.name === "workspace/data/db/assistant.db");
+    const dbEntry = entries.find(
+      (e) => e.name === "workspace/data/db/assistant.db",
+    );
     expect(dbEntry).toBeDefined();
     expect(dbEntry!.data.length).toBe(SQLITE_HEADER.length);
     // Verify the exported data matches the test fixture exactly

package/src/__tests__/migration-import-commit-http.test.ts

@@ -671,7 +671,12 @@ describe("commitImport", () => {
   test("creates parent directories if they do not exist", () => {
     // Use a workspace that does not exist yet
     const nonexistentWorkspace = join(testDir, "new-workspace");
-    const expectedDbPath = join(nonexistentWorkspace, "data", "db", "assistant.db");
+    const expectedDbPath = join(
+      nonexistentWorkspace,
+      "data",
+      "db",
+      "assistant.db",
+    );
 
     const dbData = new Uint8Array([0x01, 0x02, 0x03]);
     const vbundle = createValidVBundle([
@@ -836,7 +841,11 @@ describe("commitImport — workspace clearing", () => {
       { path: "hooks/new-hook/hook.sh", data: hookData },
     ]);
 
-    const resolver = new DefaultPathResolver(undefined, testDir, externalHooksDir);
+    const resolver = new DefaultPathResolver(
+      undefined,
+      testDir,
+      externalHooksDir,
+    );
     const result = commitImport({
       archiveData: vbundle,
       pathResolver: resolver,
@@ -847,7 +856,9 @@ describe("commitImport — workspace clearing", () => {
     if (!result.ok) return;
 
     // Hook written to the external hooks dir, not workspace/hooks/
-    expect(existsSync(join(externalHooksDir, "new-hook", "hook.sh"))).toBe(true);
+    expect(existsSync(join(externalHooksDir, "new-hook", "hook.sh"))).toBe(
+      true,
+    );
     expect(
       readFileSync(join(externalHooksDir, "new-hook", "hook.sh"), "utf8"),
     ).toBe("#!/bin/sh\necho new");
@@ -864,7 +875,10 @@ describe("commitImport — workspace clearing", () => {
     );
 
     const vbundle = createValidVBundle([
-      { path: "skills/new-skill/SKILL.md", data: new TextEncoder().encode("new") },
+      {
+        path: "skills/new-skill/SKILL.md",
+        data: new TextEncoder().encode("new"),
+      },
     ]);
 
     const resolver = new DefaultPathResolver(undefined, testDir);

package/src/__tests__/migration-import-preflight-http.test.ts

@@ -743,9 +743,7 @@ describe("DefaultPathResolver", () => {
       undefined,
       "/home/user/.vellum/workspace",
     );
-    expect(
-      resolver.resolve("skills/../../../.ssh/authorized_keys"),
-    ).toBeNull();
+    expect(resolver.resolve("skills/../../../.ssh/authorized_keys")).toBeNull();
   });
 
   test("returns null for skills paths when workspaceDir is not provided", () => {

package/src/__tests__/mime-builder.test.ts

@@ -98,7 +98,9 @@ describe("buildMultipartMime", () => {
       "base64",
     ).toString("utf-8");
 
-    expect(decoded).toContain("To: victim@example.com Bcc: attacker@example.com");
+    expect(decoded).toContain(
+      "To: victim@example.com Bcc: attacker@example.com",
+    );
     expect(decoded).toContain("Subject: Fwd: Hello Cc: attacker@example.com");
     expect(decoded).toContain("Cc: team@example.com X-Injected: yes");
     expect(decoded).toContain("Bcc: audit@example.com X-Another: value");
@@ -108,5 +110,4 @@ describe("buildMultipartMime", () => {
     expect(decoded).not.toContain("\r\nBcc: attacker@example.com");
     expect(decoded).not.toContain("\r\nCc: attacker@example.com");
   });
-
 });

package/src/__tests__/non-member-access-request.test.ts

@@ -624,6 +624,17 @@ describe("access-request-helper unit tests", () => {
   });
 
   test("notifyGuardianOfAccessRequest skips vellum fallback for same-channel-only routing (telegram)", async () => {
+    // Set up a telegram guardian binding with the anchor principal so
+    // guardianResolutionSource resolves to "source-channel-contact" and
+    // sameChannelOnly is true.
+    createGuardianBinding({
+      channel: "telegram",
+      guardianExternalUserId: "guardian-user-456",
+      guardianDeliveryChatId: "guardian-chat-456",
+      guardianPrincipalId: anchorPrincipalId,
+      verifiedVia: "test",
+    });
+
     mockEmitResult = {
       signalId: "sig-no-vellum",
       deduplicated: false,
@@ -657,7 +668,7 @@ describe("access-request-helper unit tests", () => {
       (d) => d.destinationChannel === "telegram",
     );
 
-    // Same-channel routing skips vellum delivery entirely — no fallback record
+    // Guardian IS verified on telegram → sameChannelOnly, no vellum fallback
     expect(vellum).toBeUndefined();
     expect(telegram).toBeDefined();
     expect(telegram!.destinationChatId).toBe("guardian-chat-456");

package/src/__tests__/notification-decision-identity.test.ts

@@ -185,6 +185,58 @@ describe("identity context in notification decision engine", () => {
     expect(capturedSystemPrompt).not.toContain("</assistant-identity>");
   });
 
+  test("large identity context is truncated in system prompt", async () => {
+    // Create an identity context that exceeds the 2000-char budget
+    mockIdentityContext = "A".repeat(3000);
+
+    configuredProvider = {
+      sendMessage: async (
+        _messages: unknown,
+        _tools: unknown,
+        systemPrompt: unknown,
+      ) => {
+        capturedSystemPrompt = systemPrompt as string;
+        return { content: [] };
+      },
+    };
+    extractedToolUse = {
+      name: "record_notification_decision",
+      input: {
+        shouldNotify: true,
+        selectedChannels: ["vellum"],
+        reasoningSummary: "LLM decision with truncated identity",
+        renderedCopy: {
+          vellum: {
+            title: "Guardian Question",
+            body: "What is the gate code?",
+          },
+        },
+        dedupeKey: "identity-truncated-test",
+        confidence: 0.9,
+      },
+    };
+
+    const signal = makeSignal();
+    await evaluateSignal(signal, ["vellum"] as NotificationChannel[]);
+
+    expect(capturedSystemPrompt).toBeDefined();
+    expect(capturedSystemPrompt).toContain("<assistant-identity>");
+    // The identity block should exist but should NOT contain the full 3000-char string
+    expect(capturedSystemPrompt).not.toContain("A".repeat(3000));
+    // It should contain the truncation marker
+    expect(capturedSystemPrompt).toContain("…[truncated]");
+    // The identity content within the block should be at most 2000 chars
+    const identityMatch = capturedSystemPrompt!.match(
+      /<assistant-identity>([\s\S]*?)<\/assistant-identity>/,
+    );
+    expect(identityMatch).toBeTruthy();
+    // The identity block includes the instruction text + the truncated context.
+    // Verify the raw identity portion is bounded.
+    const identityBlock = identityMatch![1];
+    expect(identityBlock).toContain("…[truncated]");
+    expect(identityBlock).not.toContain("A".repeat(2001));
+  });
+
   test("fallback path does not include identity context", async () => {
     mockIdentityContext = "I am Jarvis, a helpful assistant";
 

package/src/__tests__/oauth-apps-routes.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, mock, test } from "bun:test";
+
+const mockGetApp = mock((_appId: string) => ({
+  id: "app-1",
+  providerKey: "google",
+  clientId: "client-1",
+}));
+
+const mockListConnections = mock(() => [
+  {
+    id: "conn-1",
+    providerKey: "google",
+    accountInfo: "{\"email\":\"alice@example.com\"}",
+    grantedScopes: '["email","profile"]',
+    status: "active",
+    hasRefreshToken: 1,
+    expiresAt: 1735689600000,
+    createdAt: 1735689500000,
+    updatedAt: 1735689550000,
+  },
+  {
+    id: "conn-2",
+    providerKey: "google",
+    accountInfo: null,
+    grantedScopes: [],
+    status: "active",
+    hasRefreshToken: 0,
+    expiresAt: null,
+    createdAt: 1735689601000,
+    updatedAt: 1735689602000,
+  },
+]);
+
+mock.module("../oauth/oauth-store.js", () => ({
+  deleteApp: mock(() => Promise.resolve()),
+  disconnectOAuthProvider: mock(() => Promise.resolve()),
+  getApp: mockGetApp,
+  getAppClientSecret: mock(() => Promise.resolve(undefined)),
+  getConnection: mock(() => undefined),
+  getProvider: mock(() => undefined),
+  listApps: mock(() => []),
+  listConnections: mockListConnections,
+  upsertApp: mock(() =>
+    Promise.resolve({
+      id: "app-1",
+      providerKey: "google",
+      clientId: "client-1",
+      createdAt: 1735689500000,
+      updatedAt: 1735689550000,
+    }),
+  ),
+}));
+
+mock.module("../oauth/connect-orchestrator.js", () => ({
+  orchestrateOAuthConnect: mock(() =>
+    Promise.resolve({
+      success: true,
+      deferred: false,
+      grantedScopes: [],
+      accountInfo: null,
+      refreshTokenPresent: false,
+    }),
+  ),
+}));
+
+import { oauthAppsRouteDefinitions } from "../runtime/routes/oauth-apps.js";
+
+const routes = oauthAppsRouteDefinitions();
+
+function getRoute(method: string, endpoint: string) {
+  const route = routes.find(
+    (r) => r.method === method && r.endpoint === endpoint,
+  );
+  if (!route) throw new Error(`Route not found: ${method} ${endpoint}`);
+  return route;
+}
+
+describe("GET /v1/oauth/apps/:appId/connections", () => {
+  test("normalizes granted_scopes and has_refresh_token", async () => {
+    const req = new Request("http://localhost/v1/oauth/apps/app-1/connections");
+    const url = new URL(req.url);
+    const res = await getRoute("GET", "oauth/apps/:appId/connections").handler({
+      req,
+      url,
+      server: null as never,
+      authContext: null as never,
+      params: { appId: "app-1" },
+    });
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      connections: Array<{
+        granted_scopes: unknown;
+        has_refresh_token: unknown;
+      }>;
+    };
+
+    expect(body.connections[0]?.granted_scopes).toEqual(["email", "profile"]);
+    expect(body.connections[0]?.has_refresh_token).toBe(true);
+    expect(body.connections[1]?.granted_scopes).toEqual([]);
+    expect(body.connections[1]?.has_refresh_token).toBe(false);
+  });
+});

package/src/__tests__/oauth-store.test.ts

@@ -46,6 +46,7 @@ import {
   deleteApp,
   deleteConnection,
   disconnectOAuthProvider,
+  getActiveConnection,
   getApp,
   getAppByProviderAndClientId,
   getConnection,
@@ -631,6 +632,120 @@ describe("connection operations", () => {
     });
   });
 
+  describe("getActiveConnection", () => {
+    test("returns the most recent active connection with no filters", async () => {
+      const app = await createTestApp("github", "client-1");
+
+      createConnection({
+        oauthAppId: app.id,
+        providerKey: "github",
+        grantedScopes: ["repo"],
+        hasRefreshToken: false,
+        createdAt: 1000,
+      });
+
+      const conn2 = createConnection({
+        oauthAppId: app.id,
+        providerKey: "github",
+        grantedScopes: ["repo", "user"],
+        hasRefreshToken: true,
+        createdAt: 2000,
+      });
+
+      const result = getActiveConnection("github");
+      expect(result).toBeDefined();
+      expect(result!.id).toBe(conn2.id);
+    });
+
+    test("narrows by account when provided", async () => {
+      const app = await createTestApp("github", "client-1");
+
+      const conn1 = createConnection({
+        oauthAppId: app.id,
+        providerKey: "github",
+        accountInfo: "user1@example.com",
+        grantedScopes: ["repo"],
+        hasRefreshToken: false,
+        createdAt: 1000,
+      });
+
+      createConnection({
+        oauthAppId: app.id,
+        providerKey: "github",
+        accountInfo: "user2@example.com",
+        grantedScopes: ["repo"],
+        hasRefreshToken: false,
+        createdAt: 2000,
+      });
+
+      const result = getActiveConnection("github", {
+        account: "user1@example.com",
+      });
+      expect(result).toBeDefined();
+      expect(result!.id).toBe(conn1.id);
+    });
+
+    test("narrows by clientId when provided", async () => {
+      const app1 = await createTestApp("github", "client-a");
+      const app2 = await createTestApp("github", "client-b");
+
+      const conn1 = createConnection({
+        oauthAppId: app1.id,
+        providerKey: "github",
+        grantedScopes: ["repo"],
+        hasRefreshToken: false,
+        createdAt: 1000,
+      });
+
+      createConnection({
+        oauthAppId: app2.id,
+        providerKey: "github",
+        grantedScopes: ["repo"],
+        hasRefreshToken: false,
+        createdAt: 2000,
+      });
+
+      const result = getActiveConnection("github", { clientId: "client-a" });
+      expect(result).toBeDefined();
+      expect(result!.id).toBe(conn1.id);
+    });
+
+    test("returns undefined when clientId has no matching app", async () => {
+      const app = await createTestApp("github", "client-1");
+
+      createConnection({
+        oauthAppId: app.id,
+        providerKey: "github",
+        grantedScopes: ["repo"],
+        hasRefreshToken: false,
+      });
+
+      const result = getActiveConnection("github", {
+        clientId: "nonexistent",
+      });
+      expect(result).toBeUndefined();
+    });
+
+    test("skips revoked connections", async () => {
+      const app = await createTestApp("github", "client-1");
+
+      const conn = createConnection({
+        oauthAppId: app.id,
+        providerKey: "github",
+        grantedScopes: ["repo"],
+        hasRefreshToken: false,
+      });
+      updateConnection(conn.id, { status: "revoked" });
+
+      const result = getActiveConnection("github");
+      expect(result).toBeUndefined();
+    });
+
+    test("returns undefined when no connections exist", () => {
+      expect(getActiveConnection("github")).toBeUndefined();
+    });
+  });
+
   describe("getConnectionByProvider", () => {
     test("returns the most recent active connection", async () => {
       const app = await createTestApp("github", "client-1");

package/src/__tests__/provider-error-scenarios.test.ts

@@ -68,9 +68,7 @@ mock.module("../util/retry.js", () => {
       const causeCode = (error.cause as NodeJS.ErrnoException).code;
       if (causeCode && retryableCodes.has(causeCode)) return true;
     }
-    if (
-      RETRYABLE_NETWORK_MESSAGE_PATTERNS.some((p) => p.test(error.message))
-    ) {
+    if (RETRYABLE_NETWORK_MESSAGE_PATTERNS.some((p) => p.test(error.message))) {
       return true;
     }
     const cause = error.cause;

package/src/__tests__/provider-failover-actual-provider.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, mock, test } from "bun:test";
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
+}));
+
+import { FailoverProvider } from "../providers/failover.js";
+import type {
+  Message,
+  Provider,
+  ProviderResponse,
+} from "../providers/types.js";
+import { ProviderError } from "../util/errors.js";
+
+const MESSAGES: Message[] = [
+  { role: "user", content: [{ type: "text", text: "Hello" }] },
+];
+
+function successResponse(
+  overrides?: Partial<ProviderResponse>,
+): ProviderResponse {
+  return {
+    content: [{ type: "text", text: "ok" }],
+    model: "test-model",
+    usage: { inputTokens: 10, outputTokens: 5 },
+    stopReason: "end_turn",
+    ...overrides,
+  };
+}
+
+describe("FailoverProvider actual provider propagation", () => {
+  test("stamps the winning provider when failover uses a fallback", async () => {
+    const primary: Provider = {
+      name: "openrouter",
+      async sendMessage() {
+        throw new ProviderError("down", "openrouter", 500);
+      },
+    };
+    const secondary: Provider = {
+      name: "fireworks",
+      async sendMessage() {
+        return successResponse();
+      },
+    };
+
+    const provider = new FailoverProvider([primary, secondary]);
+    const response = await provider.sendMessage(MESSAGES);
+
+    expect(response.actualProvider).toBe("fireworks");
+  });
+
+  test("preserves an inner provider's actual provider when already set", async () => {
+    const inner: Provider = {
+      name: "retry-wrapper",
+      async sendMessage() {
+        return successResponse({ actualProvider: "anthropic" });
+      },
+    };
+
+    const provider = new FailoverProvider([inner]);
+    const response = await provider.sendMessage(MESSAGES);
+
+    expect(response.actualProvider).toBe("anthropic");
+  });
+});

package/src/__tests__/recording-handler.test.ts

@@ -81,6 +81,23 @@ const mockAttachments: Array<{
 let mockAttachmentIdCounter = 0;
 
 mock.module("../memory/attachments-store.js", () => ({
+  attachFileBackedAttachmentToMessage: (
+    _messageId: string,
+    _position: number,
+    filename: string,
+    mimeType: string,
+    _filePath: string,
+    sizeBytes: number,
+  ) => {
+    const att = {
+      id: `att-${++mockAttachmentIdCounter}`,
+      originalFilename: filename,
+      mimeType,
+      sizeBytes,
+    };
+    mockAttachments.push(att);
+    return att;
+  },
   uploadFileBackedAttachment: (
     filename: string,
     mimeType: string,

package/src/__tests__/registry.test.ts

@@ -109,7 +109,7 @@ describe("tool registry dynamic-tools tools", () => {
 
 describe("tool manifest", () => {
   test("eager module tool names list contains expected count", () => {
-    expect(eagerModuleToolNames.length).toBe(11);
+    expect(eagerModuleToolNames.length).toBe(9);
   });
 
   test("explicit tools list includes memory and credential tools", () => {
@@ -187,14 +187,9 @@ describe("baseline characterization: core app tool surface", () => {
 
     const nonProxyAppTools = [
       "app_create",
-      "app_list",
-      "app_query",
-      "app_update",
       "app_delete",
-      "app_file_list",
-      "app_file_read",
-      "app_file_edit",
-      "app_file_write",
+      "app_generate_icon",
+      "app_refresh",
     ];
 
     for (const name of nonProxyAppTools) {

package/src/__tests__/relay-server.test.ts

@@ -159,7 +159,7 @@ mock.module("../providers/registry.js", () => {
     getDefaultModel: (providerName: string) => {
       const defaults: Record<string, string> = {
         anthropic: "claude-opus-4-6",
-        openai: "gpt-5.2",
+        openai: "gpt-5.4",
         gemini: "gemini-3-flash",
         ollama: "llama3.2",
         fireworks: "accounts/fireworks/models/kimi-k2p5",

package/src/__tests__/runtime-attachment-metadata.test.ts

@@ -116,7 +116,7 @@ describe("Runtime attachment metadata", () => {
     );
 
     // Upload and link an attachment using "self" as the assistantId
-    const stored = uploadAttachment("chart.png", "image/png", "iVBOR");
+    const stored = uploadAttachment("chart.png", "image/png", "iVBORw==");
     linkAttachmentToMessage(assistantMsg.id, stored.id, 0);
 
     const res = await fetch(
@@ -181,7 +181,11 @@ describe("Runtime attachment metadata", () => {
   });
 
   test("GET /attachments/:id returns attachment with payload", async () => {
-    const stored = uploadAttachment("report.pdf", "application/pdf", "JVBER");
+    const stored = uploadAttachment(
+      "report.pdf",
+      "application/pdf",
+      "JVBERA==",
+    );
 
     const res = await fetch(
       `http://127.0.0.1:${port}/v1/attachments/${stored.id}`,
@@ -201,7 +205,7 @@ describe("Runtime attachment metadata", () => {
     expect(body.filename).toBe("report.pdf");
     expect(body.mimeType).toBe("application/pdf");
     expect(body.kind).toBe("document");
-    expect(body.data).toBe("JVBER");
+    expect(body.data).toBe("JVBERA==");
     expect(body.sizeBytes).toBeGreaterThan(0);
   });